CVE-2026-87950: Drupal miniorange_saml Module Credential Disclosure Vulnerability
Summary
CVE-2026-87950: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. Affects drupal/miniorange_saml versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The miniorange_saml module for Drupal enables the configuration of a Drupal site as a SAML 2.0 Service Provider, allowing users to authenticate through external identity providers. This module is designed to facilitate secure user authentication and streamline the login process for users relying on SAML-based identity providers. However, it contains embedded credentials that, if exposed, could lead to unauthorized access to associated services.
Vulnerability Detail
The vulnerability arises from the presence of embedded credentials within the miniorange_saml module. Under certain circumstances, these credentials may be disclosed, potentially allowing attackers to gain access to sensitive information about the services associated with the module. This could lead to unauthorized access and compromise the security of the Drupal site and its users.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the miniorange_saml module until the update is applied. This can be done through the Drupal admin interface or by using Drush with the command: 'drush pm-disable miniorange_saml'.
Conclusion
The miniorange_saml module for Drupal has a critical vulnerability (CVE-2026-87950) that could lead to the disclosure of sensitive credentials. It is essential to update the module to version 3.2.0 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
The miniorange_saml module allows Drupal sites to act as SAML 2.0 Service Providers, enabling user authentication through external identity providers.
CVE-2026-87950 refers to a vulnerability in the miniorange_saml module that may lead to the disclosure of embedded credentials, potentially compromising associated services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the module right away, consider disabling it as a temporary measure to mitigate the risk of credential exposure.
For more information, you can reach out to Sudhanshu Dhage, the credited researcher, through their Drupal profile at https://www.drupal.org/u/sudhanshu0542.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
