Brute Force Vulnerability in Drupal SAML SSO - Service Provider
CVE-2026-87946

4.8MEDIUM

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87946?

The Drupal SAML SSO - Service Provider is affected by an Observable Timing Discrepancy vulnerability that can be exploited for Brute Force attacks. Versions from 0.0.0 to 3.2.0 are impacted by this issue, potentially allowing attackers to gain unauthorized access by analyzing the response times of authentication requests. It is crucial for users of affected versions to implement mitigations immediately to protect against potential exploitation.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-144

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sudhanshu Dhage (sudhanshu0542)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.