Server-Side Request Forgery Vulnerability in Drupal SAML SSO Plugin
CVE-2026-87953

Currently unrated

Key Information:

Vendor

Drupal
Status
Saml Sso - Service Provider
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87953?

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal SAML SSO - Service Provider plugin, which can allow an attacker to send crafted requests through the server to other internal and external services. This type of vulnerability can potentially expose sensitive data or lead to further exploitation of the affected system. It impacts SAML SSO - Service Provider versions from 0.0.0 to 3.2.0. It is crucial for users to apply the necessary patches and updates to safeguard their Drupal installations.

Affected Version(s)

SAML SSO - Service Provider 0.0.0 < 3.2.0

References

https://www.drupal.org/sa-contrib-2026-151

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows (hsjbrianwillows)
Roushan Kumar Singh (roushan59227)
Sudhanshu Dhage (sudhanshu0542)
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.