SA-CONTRIB-2026-142: Critical severity drupal/miniorange_saml vulnerability
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network traffic could impersonate a trusted remote service and influence communications performed by the module. This vulnerability is mitigated by the fact that an attacker must be able to intercept or redirect network traffic originating from the site.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/miniorange_samlto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Drupal sites using the miniorange_saml module are exposed when the module makes outbound HTTPS requests to remote services. Exploitation requires an attacker to be able to intercept or redirect network traffic originating from the site.
What does an attacker need to exploit the vulnerability?
The attacker must be in a position to intercept network traffic or redirect it between the Drupal site and a remote service. They could then impersonate a trusted remote service because TLS certificates are not properly validated.
How could exploitation affect module communications?
An attacker able to perform the required network interception could influence communications performed by the module while impersonating a trusted remote service.