Drupal SAML SSO EUVD-2026-107851

The affected software must be the Drupal contrib module 'SAML SSO - Service Provider' at any version from 0.0.0 up to and including 3.2.0; upgrading past 3.2.0 removes the flaw. The root cause is a hard-coded credential (CWE-798) embedded in the module, and the described outcome is retrieval of embedded sensitive data. The available sources do not state the specific endpoint, request, or configuration that exposes the credential, so the trigger is not described in the available sources. Limiting factors on impact: the flaw is confidentiality-only (C:L, with I:N and A:N), so it discloses data but does not grant modification or denial of service; severity is Medium (5.3), EPSS is very low, and there is no evidence of active exploitation.

Signals converge on a genuine but non-urgent, moderate-severity issue rather than an emergency. The CVSS 3.1 base score is 5.3 (Medium) with a confidentiality-only impact (C:L/I:N/A:N), meaning the flaw leaks embedded sensitive data but does not by itself alter or disable the system. The vector (AV:N/AC:L/PR:N/UI:N) implies network-reachable, low-complexity, unauthenticated access; however, note the authentication qualifier is taken from the CVSS PR:N field only - the advisory text does not describe the trigger mechanism, so exactly how the hard-coded credential is reached is unverified. EPSS is very low (0.14%, 3rd percentile) and there is no CISA KEV listing and no public exploit or PoC reference in the provided data, so this is not evidenced as widely exploited. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the low EPSS and absence of KEV. One internal conflict: the input Tags assert 'Authentication Bypass', but the CVSS vector shows I:N and the description states only 'Retrieve Embedded Sensitive Data' - these point to information disclosure, not a full authentication bypass; treat the auth-bypass characterization as unverified. Net: a real, patch-this-month confidentiality issue in a niche contrib module, not a high-urgency mass-exploitation threat.

A remote attacker interacts with a Drupal site running the SAML SSO - Service Provider module at version 3.2.0 or earlier and extracts a credential or secret that was hard-coded into the module. Using that embedded secret, the attacker reads sensitive data that should have been protected. No public exploit code or PoC reference is identified in the available data, and the precise trigger (endpoint or feature exposing the secret) is not described in the sources.