CVE-2026-87944: SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

Q: Which deployments are affected?

Drupal sites using the SAML SSO - Service Provider module in versions from 0.0.0 through 3.2.0 are affected.

Q: What access or position does an attacker need to exploit this issue?

The vulnerability enables an adversary-in-the-middle attack, so the attacker would need a position to intercept or interfere with the relevant SAML communications.

Published Oct 22, 2026

Updated

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

Affected Software

1 affected component

Drupal SAML SSO - Service Provider>=0.0.0<=3.2.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal sites using the SAML SSO - Service Provider module in versions from 0.0.0 through 3.2.0 are affected.

What access or position does an attacker need to exploit this issue?

The vulnerability enables an adversary-in-the-middle attack, so the attacker would need a position to intercept or interfere with the relevant SAML communications.

CVE-2026-87944: SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access or position does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access or position does an attacker need to exploit this issue?