Use of Hard-Coded Credentials in Drupal SAML SSO - Service Provider
CVE-2026-87950

Currently unrated

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87950?

A vulnerability in the SAML SSO - Service Provider component of Drupal has been identified, stemming from the use of hard-coded credentials. This flaw may allow unauthorized access to sensitive embedded data, potentially leading to data leaks or other malicious activities. Versions affected range from 0.0.0 to 3.2.0, emphasizing the urgency for users to update to secure their systems.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-148

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sudhanshu Dhage (sudhanshu0542)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.