CVE-2026-5343: Authentication Bypass Vulnerability in Drupal miniorange_saml Module
Summary
CVE-2026-5343: This module enables you to perform SAML-protocol-based single-sign-on (SSO) on a Drupal site. Affects drupal/miniorange_saml versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The miniorange_saml module is designed to facilitate SAML-protocol-based single-sign-on (SSO) for Drupal sites. This module allows users to authenticate seamlessly across different applications using SAML, enhancing user experience and security. However, it has been identified that the module does not adequately restrict access, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from insufficient access controls within the miniorange_saml module, allowing unauthorized users to bypass authentication mechanisms. This could potentially lead to unauthorized access to sensitive information or functionalities within the Drupal site. The flaw is particularly concerning as it undermines the core purpose of the SSO feature, which is to provide secure and controlled access to applications.
How To Fix
Minimum fixed version
3.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the SSO functionality by implementing additional access control measures within your Drupal site. This may involve configuring user roles and permissions to limit access until the module is updated.
Conclusion
The miniorange_saml module has a critical authentication bypass vulnerability (CVE-2026-5343) that needs immediate attention. Updating to version 3.1.4 or later is crucial to ensure the security of your Drupal site. Implementing temporary access controls can help mitigate risks until the update is applied.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
The miniorange_saml module enables SAML-based single-sign-on (SSO) for Drupal sites, allowing users to authenticate across multiple applications seamlessly.
The authentication bypass vulnerability allows unauthorized users to gain access to the Drupal site without proper authentication, posing a significant security risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing additional access controls to limit access to the SSO functionality as a temporary measure.
For more information, you can reach out to Tim de Jong, a freelance Drupal developer, via his Drupal profile at https://www.drupal.org/u/tim_dj.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
