CVE-2026-87949: SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147

Q: Which versions need to be reviewed for this issue?

Drupal SAML SSO - Service Provider versions from 0.0.0 through 3.2.0 are affected.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

Affected Software

1 affected component

Drupal SAML SSO - Service Provider>=0.0.0<=3.2.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which versions need to be reviewed for this issue?

Drupal SAML SSO - Service Provider versions from 0.0.0 through 3.2.0 are affected.

CVE-2026-87949: SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147

Affected Software

Event History

Frequently Asked Questions

Which versions need to be reviewed for this issue?

Company

Resources

Contact

Frequently Asked Questions

Which versions need to be reviewed for this issue?