Cross-site Scripting Vulnerability in Drupal SAML SSO - Service Provider
CVE-2026-87948

Currently unrated

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87948?

A Cross-site Scripting (XSS) vulnerability exists in the Drupal SAML SSO - Service Provider, which improperly handles input during web page generation. Attackers can exploit this flaw to execute malicious scripts in the context of affected users, potentially leading to session hijacking, data theft, or defacement of web content. This issue affects versions from 0.0.0 to 3.2.0 and poses significant risks to applications utilizing this service for single sign-on capabilities.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-146

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sudhanshu Dhage (sudhanshu0542)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.