CVE-2026-87952: Vulnerability in miniorange_saml Allows Replay of SAML Assertions
Summary
CVE-2026-87952: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. Affects drupal/miniorange_saml versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The miniorange_saml module for Drupal enables sites to function as SAML 2.0 Service Providers, facilitating user authentication through external identity providers. This module is widely used for integrating single sign-on (SSO) capabilities into Drupal applications, enhancing user experience and security. However, it has a critical vulnerability that can compromise the authentication process.
Vulnerability Detail
The vulnerability arises from the module's inadequate prevention of the reuse of previously accepted SAML assertions. An attacker who obtains a valid SAML assertion can replay it within its validity period, allowing unauthorized repeated authentication attempts. This flaw poses a significant risk, especially in environments where sensitive data is accessed based on user authentication.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional monitoring of SAML assertions and limit the number of authentication attempts from a single source. However, this is not a substitute for updating the module to the patched version.
Conclusion
The CVE-2026-87952 vulnerability in the miniorange_saml module poses a significant risk by allowing the replay of valid SAML assertions. It is crucial for users of this module to update to version 3.2.0 or later to mitigate this risk. Implementing additional security measures can provide temporary relief until the update is applied.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
CVE-2026-87952 is a vulnerability in the miniorange_saml module that allows attackers to replay valid SAML assertions, potentially leading to unauthorized access.
If you are using the miniorange_saml module version lower than 3.2.0, your site is vulnerable. You can check your version in the Drupal admin interface or by inspecting your composer.lock file.
If immediate updates are not possible, consider implementing additional security measures such as monitoring authentication attempts and limiting access based on user roles.
Detailed information about CVE-2026-87952 can be found in the official advisory and on security-focused platforms like the Drupal Security Team's advisory database.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
