Cross-site Scripting Vulnerability in Drupal SAML SSO - Service Provider
CVE-2026-87948

3.5LOW

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87948?

A Cross-site Scripting (XSS) vulnerability exists in the Drupal SAML SSO - Service Provider, which improperly handles input during web page generation. Attackers can exploit this flaw to execute malicious scripts in the context of affected users, potentially leading to session hijacking, data theft, or defacement of web content. This issue affects versions from 0.0.0 to 3.2.0 and poses significant risks to applications utilizing this service for single sign-on capabilities.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-146

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sudhanshu Dhage (sudhanshu0542)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.