Drupal SAML SSO EUVD-2026-33228

The target Drupal site must have the contributed 'SAML SSO - Service Provider' module installed and enabled at a version below 3.1.4, with its Assertion Consumer Service endpoint reachable by the attacker over the network - typical for any internet-facing SSO deployment. Exploitation requires no prior authentication and no user interaction (PR:N/UI:N), but the CVSS attack complexity is High (AC:H), meaning the attacker must craft a SAML message that satisfies a specific exceptional-condition trigger the module fails to reject, which likely depends on particular IdP metadata, assertion structure, signature handling state, or role-mapping configuration not fully described in the public advisory. Sites that do not use this specific Drupal contributed module, or that have already upgraded to 3.1.4+, are not exploitable; sites using a different SAML implementation for Drupal (such as simplesamlphp_auth) are out of scope.

Signals are mixed and pull in different directions. The CVSS vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N) indicates remote, unauthenticated exploitation with high impact on confidentiality and integrity, but AC:H means a successful attack depends on conditions outside the attacker's control - likely a specific timing, IdP configuration, or assertion shape - which raises the bar substantially. EPSS is extremely low at 0.02% (5th percentile) and there is no KEV listing and no public exploit identified at time of analysis, suggesting this is not currently being exploited at scale. The combination of unauthenticated network reach plus privilege escalation against an authentication module is inherently sensitive, so Drupal sites running this contributed module - especially those exposing SSO to the public internet - should patch promptly, but this is not a fire-drill issue absent additional exploitation signals. No public POC code or detailed technical write-up was provided in the inputs, so the specific exceptional condition that must be triggered is not confirmed.

A remote unauthenticated attacker sends a specially crafted SAML response or assertion to the Drupal site's Assertion Consumer Service endpoint, shaped to trigger the exceptional condition the module fails to check. Because the module mishandles this edge case, the SAML flow completes in an unintended state that maps the attacker to an authenticated Drupal session with elevated role assignments, yielding administrative or otherwise privileged access. No public exploit code has been identified at time of analysis, and the high CVSS attack complexity (AC:H) implies the attacker must satisfy non-trivial conditions to reliably reach the vulnerable branch.