CVE-2026-87947: Vulnerability in miniorange_saml Package Allows Signature Algorithm Manipulation
Summary
CVE-2026-87947: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. Affects drupal/miniorange_saml versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The miniorange_saml module enables Drupal sites to function as SAML 2.0 Service Providers, facilitating user authentication via external identity providers. This module is widely used for integrating SAML-based single sign-on (SSO) capabilities into Drupal applications, enhancing user experience and security. However, it has a critical vulnerability that can compromise the integrity of the authentication process.
Vulnerability Detail
The vulnerability arises from the module's failure to properly restrict the signature algorithm used to validate SAML assertions. This oversight allows an attacker to influence the signature algorithm based on the incoming SAML response, potentially leading to unauthorized access if a crafted SAML response is submitted to the affected site. The risk is heightened in environments where the integrity of the SAML assertions cannot be guaranteed.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the types of SAML responses accepted by your application, ensuring that only responses from trusted identity providers are processed. However, this is not a substitute for updating the package.
Conclusion
The miniorange_saml module has a significant vulnerability (CVE-2026-87947) that allows for manipulation of the signature algorithm used in SAML assertions. It is crucial for users of this module to update to version 3.2.0 or later to mitigate the risk of unauthorized access. Regular monitoring and adherence to security best practices are recommended.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
CVE-2026-87947 is a vulnerability in the miniorange_saml module for Drupal that allows attackers to manipulate the signature algorithm used for validating SAML assertions.
If you are using a version of the miniorange_saml module prior to 3.2.0, your site is vulnerable. You can check your version in the Drupal admin interface or by inspecting your composer.lock file.
An attacker could potentially submit a crafted SAML response, leading to unauthorized access to your Drupal site, which could compromise user data and site integrity.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json to function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
