CVE-2026-87947: SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

Q: Which installations are affected?

Drupal installations using the SAML SSO - Service Provider module in versions from 0.0.0 through 3.2.0 are affected.

Q: What type of attack does this enable?

The vulnerability is an improper verification of cryptographic signatures issue that allows signature spoofing and can lead to authentication bypass.

Published Oct 22, 2026

Updated

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

Affected Software

1 affected component

Drupal SAML SSO - Service Provider>=0.0.0<=3.2.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Drupal installations using the SAML SSO - Service Provider module in versions from 0.0.0 through 3.2.0 are affected.

What type of attack does this enable?

The vulnerability is an improper verification of cryptographic signatures issue that allows signature spoofing and can lead to authentication bypass.

CVE-2026-87947: SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What type of attack does this enable?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What type of attack does this enable?