CVE-2026-87953: Vulnerability in miniorange_saml Allows Unintended URL Requests
Summary
CVE-2026-87953: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. Affects drupal/miniorange_saml versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The miniorange_saml module enables Drupal sites to function as SAML 2.0 Service Providers, facilitating user authentication through external identity providers. This module is crucial for organizations that require single sign-on capabilities, enhancing user experience and security. However, it is susceptible to vulnerabilities that can compromise its intended functionality.
Vulnerability Detail
The vulnerability arises from insufficient validation of URLs obtained from identity provider metadata. An attacker with the ability to configure this metadata can manipulate the application to make requests to unintended destinations. This could potentially expose internal network resources to unauthorized access, posing a significant security risk. The vulnerability is particularly concerning as it requires an attacker to have permission to configure identity provider metadata, which may not be easily accessible in all environments.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict permissions for configuring identity provider metadata to trusted users only. This will help mitigate the risk of unauthorized access while you work on applying the patch.
Conclusion
The CVE-2026-87953 vulnerability in the miniorange_saml module poses a significant risk by allowing unauthorized URL requests through improperly validated metadata. It is crucial to update to the latest version to mitigate this risk and ensure the security of your Drupal site.
See every vulnerability recorded for drupal/miniorange_saml →
FAQ
CVE-2026-87953 is a vulnerability in the miniorange_saml module for Drupal that allows attackers to manipulate URL requests through improperly validated identity provider metadata.
If you are using a version of the miniorange_saml module that is below 3.2.0, your site may be vulnerable. You can check your version in the Drupal admin interface or by inspecting your composer.json file.
If an immediate update is not possible, ensure that only trusted users have permission to configure identity provider metadata as a temporary workaround.
You can find detailed information about CVE-2026-87953 in the official advisory published by the Drupal Security Team.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check if your application is affected by vulnerabilities without needing to access the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/miniorange_saml.
