Cross-Site Scripting Vulnerability in Drupal SAML Single Sign-On Service Provider

CVE-2026-87949

What is CVE-2026-87949?

A Cross-Site Scripting (XSS) vulnerability exists in the SAML Single Sign-On (SSO) - Service Provider for Drupal, affecting versions from 0.0.0 to 3.2.0. This flaw stems from improper handling of user input during web page generation, leading to potential exploitation by attackers. Successful exploitation allows unauthorized scripts to be executed in the context of a user's session, posing risks such as session hijacking, defacement, or data theft. It is critical for users of affected versions to apply necessary patches and ensure web applications are secured against such vulnerabilities.

References