CVE-2026-87946

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0

Description The module allows a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. It employs cryptographic constructions that deviate from security best practices. Specifically, the module uses non constant-time comparison logic for signature comparisons, which creates an observable timing discrepancy that may allow brute force attacks. Additionally, it generates SAML request identifiers using predictable values from non-cryptographic random number generation. These weaknesses may reduce the security margin of SAML authentication workflows.

Recommendations Update Drupal SAML SSO - Service Provider to a version later than 3.2.0.