What is the CVSS score of EUVD-2026-33228?

EUVD-2026-33228 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Drupal SAML SSO are affected by EUVD-2026-33228?

The Drupal SAML SSO - Service Provider module (versions before 3.1.4) contains a privilege escalation vulnerability allowing unauthenticated attackers to gain elevated system access.. A patch is available.

How to fix or mitigate EUVD-2026-33228?

24 hours: Identify and document all Drupal instances using the SAML SSO - Service Provider module and their current versions. 7 days: Apply patch to version 3.1.4 or later to all affected instances. 30 days: Complete deployment across all environments, validate SAML authentication functionality, and document patch compliance.

Drupal SAML SSO EUVD-2026-33228

| CVE-2026-5343 HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-05-28 mlhess@drupal.org

GHSA-9622-2jm8-94x7

Privilege Escalation Saml Sso Service Provider

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 20:22 vuln.today

CVSS changed

May 29, 2026 - 20:22 NVD

7.4 (HIGH)

CVE Published

May 28, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation.

This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.

AnalysisAI

Privilege escalation in the Drupal SAML SSO - Service Provider contributed module (versions prior to 3.1.4) allows remote unauthenticated attackers to gain elevated privileges by exploiting improper handling of exceptional conditions during SAML authentication flows. The CVSS 7.4 (High) score reflects high attack complexity but network reachability and no authentication requirement, with confidentiality and integrity impact. EPSS probability is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the Drupal SAML SSO - Service Provider contributed module, which implements the Service Provider (SP) side of the SAML 2.0 single sign-on protocol for Drupal sites, allowing Drupal to consume SAML assertions issued by an Identity Provider (IdP). The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), meaning the module fails to properly validate or reject malformed, unexpected, or edge-case states in the SAML assertion processing or session/role mapping logic. In SAML SP implementations, such checks typically guard against malformed assertions, missing attributes, signature validation failures, or unexpected NameID/role mappings - when these checks are bypassed or skipped, a crafted assertion can lead to an authenticated session being established with elevated privileges that should not have been granted.

RemediationAI

Upgrade the Drupal SAML SSO - Service Provider contributed module to version 3.1.4 or later, which is the vendor-released patch as referenced in the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-031. As an interim compensating control until the upgrade can be staged, administrators can temporarily disable the SAML SSO - Service Provider module via Drupal's module administration, which will break SSO login flows and force users back to local authentication or an alternative login path - a meaningful availability and UX trade-off, but it eliminates the attack surface. Where SSO cannot be taken offline, restrict network access to the SAML Assertion Consumer Service (ACS) endpoint to only the trusted IdP source IPs at the web server or WAF layer, accepting that this assumes a static, known IdP egress range and offers no protection if the IdP itself is compromised or its egress IPs are not strictly bounded.