PT-2026-89247

CVE-2026-87948

Published

2026-09-09

Updated

2026-10-22

Description by

CVSS 3.1

3.5

Low

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAML SSO - Service Provider versions 0.0.0 through 3.2.0

Description This module allows a Drupal site to function as a SAML 2.0 Service Provider for authentication via an external identity provider. The issue occurs because the module does not sufficiently sanitize user-supplied data before displaying it in generated HTML, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

Recommendations Update SAML SSO - Service Provider to a version later than 3.2.0.

Exploitability

Exploit

Fix

Impacts

Researchers