CVE-2026-87951: Drupal miniorange_saml Package Sensitive Data Exposure Vulnerability
Summary
CVE-2026-87951: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. Affects drupal/miniorange_saml versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The miniorange_saml module for Drupal enables the configuration of a Drupal site as a SAML 2.0 Service Provider, allowing users to authenticate through an external identity provider. This module is designed to facilitate secure user authentication, but it has been found to store sensitive authentication information in a way that could be exposed to unauthorized users.
Vulnerability Detail
This vulnerability arises from the way the miniorange_saml module handles sensitive authentication data. It stores this information in a manner that could potentially allow disclosure to users who have access to configuration or related system data. The risk is particularly significant because an attacker must first gain access to the configuration or underlying storage mechanisms to exploit this vulnerability, but if successful, they could compromise user authentication and access sensitive information.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that access to configuration settings and related system data is restricted to only trusted users. Regularly audit user permissions and monitor access logs to detect any unauthorized attempts to access sensitive information.
Conclusion
The miniorange_saml module for Drupal has a vulnerability (CVE-2026-87951) that could expose sensitive authentication data. It is crucial to update to version 3.2.0 or later to mitigate this risk. Additionally, implementing strict access controls can help protect sensitive information until the update can be applied.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
The miniorange_saml module allows Drupal sites to act as SAML 2.0 Service Providers, enabling user authentication through external identity providers.
CVE-2026-87951 refers to a vulnerability in the miniorange_saml module that could lead to the exposure of sensitive authentication information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that access to sensitive configuration data is tightly controlled and monitored.
For more information, you can reach out to Sudhanshu Dhage, who reported the vulnerability, through their Drupal profile at https://www.drupal.org/u/sudhanshu0542.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
