SA-CONTRIB-2026-145: Critical severity drupal/miniorange_saml vulnerability
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced by the incoming response rather than being tied to the type of key configured for the Identity Provider (IdP). The vulnerability is mitigated by the fact that an attacker must be able to submit a crafted SAML response to the affected site.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/miniorange_samlto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker must be able to submit a crafted SAML response to the affected Drupal site. The advisory identifies this as a mitigating factor.
Which deployments are exposed?
Deployments using the Drupal miniorange_saml module as a SAML 2.0 Service Provider are affected when they validate SAML assertions from an external Identity Provider. The supplied information does not identify affected versions or configuration-specific exceptions.
What validation behavior is unsafe?
The module permits the signature algorithm to be influenced by the incoming SAML response rather than restricting it according to the key type configured for the Identity Provider. This means assertion signature validation is not bound to the configured IdP key type.