Drupal SAML SSO Service Provider Auth Flaws

The Drupal 'SAML SSO - Service Provider' contributed module (all versions before 3.2.0) omits an authorization check on at least one protected resource, so remote unauthenticated attackers can reach it directly through forceful browsing rather than through the intended SAML-authenticated flow. Successful abuse is bounded to low confidentiality and low integrity impact with no availability effect, and the trigger requires the module to be installed and enabled on a Drupal site plus knowledge or discovery of the specific protected URL. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile), and a vendor patch is available.

The contributed Drupal module SAML SSO - Service Provider (versions 0.0.0 through 3.2.0) contains an open-redirect weakness that lets an attacker craft a link which sends a victim to an untrusted destination under the guise of the trusted Drupal site, enabling phishing and source-of-data spoofing. No authentication is required of the attacker (CVSS 3.1 vector PR:N), but the attack cannot succeed without a victim clicking the crafted link (UI:R), and impact is limited to low confidentiality and integrity effects with no availability loss. Exploitation has not been confirmed via CISA KEV and no public exploit code was identified at time of analysis; EPSS is 0.14% (3rd percentile), and the risk picture is consistent with a medium-severity, socially engineered redirect issue rather than an emergency - a vendor fix is available by upgrading past 3.2.0.

Unauthenticated remote retrieval of embedded sensitive data is possible in the Drupal contrib module 'SAML SSO - Service Provider' versions 0.0.0 through 3.2.0, because the module ships a hard-coded credential (CWE-798) rather than generating or requiring a site-specific secret. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) is confidentiality-only: an attacker can read exposed data but cannot modify it or cause denial of service. EPSS is 0.14% (3rd percentile), there is no KEV listing and no public exploit identified at time of analysis, so the issue is genuine but non-urgent; a vendor patch is available and upgrading past 3.2.0 removes the flaw.

The Drupal SAML SSO - Service Provider module (versions 0.0.0 through 3.2.0) fails to properly validate the certificate presented on the connection between the Service Provider and its SAML Identity Provider, allowing an attacker who already holds an adversary-in-the-middle position on that path to intercept or alter the SAML exchange (CWE-295). Impact is bounded: confidentiality and integrity are partially affected while availability is not, giving a CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N); the high attack complexity reflects the MITM precondition rather than any authentication barrier, since exploitation is unauthenticated once that foothold exists. No public exploit code was identified at time of analysis and the module is not in CISA KEV; EPSS is 0.10% (1st percentile), so this is a genuine but low-urgency patching item rather than an emergency.

Improper verification of cryptographic signatures in the Drupal SAML SSO - Service Provider module (versions 0.0.0 through 3.2.0) allows a remote attacker to spoof SAML assertions and have them accepted by a site acting as a SAML Service Provider, yielding limited confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) indicates no authentication or user interaction is required but that the attack is complex to carry out; the trigger is not described in the available sources. This is a genuinely moderate, not high-priority, issue: EPSS is 0.10% (1st percentile), there is no CISA KEV entry, no public exploit identified at time of analysis, and a vendor patch is available, giving a 'this_month' priority.

Timing side-channel leakage in Drupal's SAML SSO - Service Provider module (reported affected range 0.0.0 through 3.2.0) can give remote attackers a measurable signal that may aid brute-force efforts against values handled by the module. The issue is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), meaning exploitation is unauthenticated but high-complexity with limited confidentiality and integrity impact; EPSS is 0.15% (4th percentile), no KEV designation is present in the supplied intelligence, and no public exploit has been identified at time of analysis. A vendor patch is available through Drupal's advisory.

Drupal sites running the SAML SSO - Service Provider contrib module at versions up to and including 3.2.0 store sensitive information insecurely, allowing a highly privileged authenticated user to retrieve embedded sensitive data. The flaw is network-reachable but requires high privileges (PR:H) on the Drupal site, and the vendor has released a patched version; no confirmed active exploitation or working exploit code was observed, and EPSS is 0.15% (4th percentile). Exploitation preconditions narrow the realistic exposure to trusted administrative accounts or already-compromised privileged sessions on sites where the module is installed and enabled.

Cross-site scripting in the Drupal contributed module SAML SSO - Service Provider affects versions 0.0.0 through 3.2.0 and allows an attacker holding a high-privilege account on the Drupal site to get script executed in another user's browser when that user loads the page carrying the injected content. Scoring is modest (CVSS 3.1 3.5, AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) because the attacker must already be elevated and a separate victim must interact, with only low confidentiality and low integrity impact and no availability effect. No public exploit code or CISA KEV entry is associated with the issue, EPSS sits at 0.16% (5th percentile), and the priority label is monitor; a vendor patch is available, with the Drupal advisory sa-contrib-2026-146 as the authoritative reference.

Server-side request forgery in the Drupal SAML SSO - Service Provider module affects versions 0.0.0 through 3.2.0 and allows a highly privileged account that can influence the module's SAML/IdP configuration to make the Drupal server send requests to attacker-influenced destinations. Impact is limited to low confidentiality and low integrity with no availability effect, and exploitation also requires high attack complexity. EPSS is 0.15% (4th percentile), no public exploit identified at time of analysis, and the priority is monitor.

Cross-site scripting (CWE-79) in the Drupal contrib module SAML SSO - Service Provider, affecting every release from 0.0.0 through 3.2.0, lets an attacker-supplied payload be rendered into a web page without proper neutralization, with low confidentiality and integrity impact. The vendor CVSS vector (AV:N/AC:H/PR:H/UI:N) requires an authenticated high-privilege account and high attack complexity, which keeps the practical exposure narrow; EPSS sits at 0.16% (5th percentile) and no public exploit identified at time of analysis, so this is a low-severity issue rather than a patching emergency. A vendor fix is available, and sites running the module should schedule the update through the normal contrib maintenance cycle.

Capture-replay of a valid SAML assertion can bypass authentication in the Drupal SAML SSO - Service Provider module for versions 0.0.0 through 3.2.0, allowing an attacker who has obtained a legitimate SAML response to replay it and gain limited access. The issue is low severity (CVSS 3.1 base score 3.1) and the available signals point to low real-world urgency: EPSS is 0.19%, no CISA KEV status is indicated in the supplied data, and no public exploit was identified at time of analysis. A vendor patch is available in 3.2.0.