Live › vulnerability › CVE-2026-87944
Go to dashboardThe Drupal SAML SSO - Service Provider module does not properly validate certificates, so a network attacker positioned between the site and its identity provider can intercept or alter SSO traffic. Versions from 0.0.0 through 3.2.0 are listed as affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that use the SAML SSO - Service Provider module to sign users in through an external identity provider are exposed. Sites that do not use this module for SSO, or that run it only on a trusted private network with no untrusted path between the site and the identity provider, are at lower risk.
No product ranges from the sources yet.
drush pm:list --filter=saml or by reviewing the module's composer.lock entry for the SAML SSO - Service Provider package.3.2.0 or earlier.3.2.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87944")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.