Cross-Site Scripting Vulnerability in Drupal SAML Single Sign-On Service Provider
CVE-2026-87949
3.3LOW
What is CVE-2026-87949?
A Cross-Site Scripting (XSS) vulnerability exists in the SAML Single Sign-On (SSO) - Service Provider for Drupal, affecting versions from 0.0.0 to 3.2.0. This flaw stems from improper handling of user input during web page generation, leading to potential exploitation by attackers. Successful exploitation allows unauthorized scripts to be executed in the context of a user's session, posing risks such as session hijacking, defacement, or data theft. It is critical for users of affected versions to apply necessary patches and ensure web applications are secured against such vulnerabilities.
Affected Version(s)
SAML SSO - Service Provider 0.0.0 < 3.2.0
References
CVSS V3.1
Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Brian Willows (hsjbrianwillows)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)