CVE-2026-87952: SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150

Q: Which deployments are affected?

Drupal installations using the SAML SSO - Service Provider module in versions from 0.0.0 through 3.2.0 are affected.

Q: What does an attacker need to exploit this issue?

The vulnerability is exploitable remotely using stolen credentials and captured authentication material that can be replayed.

Published Oct 22, 2026

Updated

Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

Affected Software

1 affected component

Drupal SAML SSO - Service Provider>=0.0.0<=3.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal SAML SSO - Service Provider to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-150

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal installations using the SAML SSO - Service Provider module in versions from 0.0.0 through 3.2.0 are affected.

What does an attacker need to exploit this issue?

The vulnerability is exploitable remotely using stolen credentials and captured authentication material that can be replayed.

CVE-2026-87952: SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?