Improper Certificate Validation in Drupal SAML SSO - Service Provider
CVE-2026-87944

Currently unrated

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87944?

A vulnerability in Drupal's SAML SSO - Service Provider has been identified that allows for improper validation of certificates. This flaw could enable an adversary to perform a Man-in-the-Middle attack, potentially compromising the integrity and confidentiality of data exchanged during authentication processes. Versions from 0.0.0 to 3.2.0 are affected, making it essential for users to implement immediate updates to safeguard their systems.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-142

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonni Kalpio (thatguy)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.