CVE-2026-87946: Vulnerability in miniorange_saml Package Allows for Potential Security Weaknesses
Summary
CVE-2026-87946: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. Affects drupal/miniorange_saml versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The miniorange_saml module enables Drupal sites to function as SAML 2.0 Service Providers, allowing users to authenticate through external identity providers. This module is designed to facilitate secure authentication workflows, but it has been found to employ cryptographic methods that do not adhere to current security best practices, potentially compromising the integrity of the authentication process.
Vulnerability Detail
The vulnerability arises from the use of non-constant-time comparison logic for signature comparisons and the generation of SAML request identifiers using predictable values derived from non-cryptographic random number generation. While no direct authentication bypass has been demonstrated, these weaknesses could diminish the overall security of SAML authentication workflows, making them susceptible to various attacks.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The miniorange_saml module has a vulnerability (CVE-2026-87946) that could compromise the security of SAML authentication workflows. It is crucial to update to version 3.2.0 or higher to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert is also recommended.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
The miniorange_saml module allows Drupal sites to act as SAML 2.0 Service Providers, enabling user authentication through external identity providers.
The vulnerability could potentially weaken the security of SAML authentication workflows, making them more susceptible to attacks, although no direct bypass has been demonstrated.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should update the miniorange_saml package to version 3.2.0 or higher to mitigate the risks associated with this vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
