Open Redirect Vulnerability in Drupal SAML SSO - Service Provider
CVE-2026-87945

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87945?

An open redirect vulnerability has been identified in the Drupal SAML SSO - Service Provider, enabling attackers to manipulate redirection URLs. This flaw can allow an attacker to redirect users to untrusted sites, potentially leading to data phishing or other malicious activities. Affected versions range from 0.0.0 to 3.2.0, creating an urgent need for users to review and mitigate their systems.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-143

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sudhanshu Dhage (sudhanshu0542)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.