CVE-2026-87949

Name of the Vulnerable Software and Affected Versions SAML SSO - Service Provider versions 0.0.0 through 3.2.0

Description This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module fails to sufficiently sanitize certain values derived from SAML assertions before displaying them to users. This allows a malicious identity provider or an attacker capable of supplying crafted SAML attributes to execute cross-site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users.

Recommendations Update SAML SSO - Service Provider to a version later than 3.2.0.