Insecure Storage of Sensitive Information in Drupal SAML SSO - Service Provider
CVE-2026-87951

3.8LOW

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87951?

The Drupal SAML SSO - Service Provider has a vulnerability that allows the retrieval of embedded sensitive data due to improper handling of secure information storage. This issue arises in versions ranging from 0.0.0 to 3.2.0, potentially exposing critical user data to unauthorized access. It is essential for users of the affected versions to address this vulnerability by implementing proper security measures and updating to the latest versions.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-149

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sudhanshu Dhage (sudhanshu0542)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.