PT-2026-89246

CVE-2026-87947

Published

2026-09-09

Updated

2026-10-22

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0

Description Improper verification of cryptographic signatures allows for signature spoofing. The module fails to properly restrict the signature algorithm used to validate a SAML assertion, enabling the algorithm to be influenced by the incoming response instead of being tied to the key type configured for the Identity Provider (IdP). An attacker must be able to submit a crafted SAML response to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers