CVE-2026-87953

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0

Description This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with permissions to configure this metadata could force the application to send requests to unintended destinations, potentially granting access to internal network resources. This is a Server-Side Request Forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an arbitrary domain.

Recommendations Update Drupal SAML SSO - Service Provider to a version later than 3.2.0.