Live › vulnerability › CVE-2026-87946
Go to dashboardThe Drupal SAML SSO Service Provider module leaks timing differences that reveal information about its checks. An attacker can use this timing signal to brute force credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that run the SAML SSO - Service Provider module at version 3.2.0 or earlier are exposed. The sources do not describe which configurations are required to trigger the timing signal. Sites without this module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=saml or by reading the module's composer.lock entry.drush pm:list --status=enabled --filter=saml.3.2.0, as the sources say versions from 0.0.0 to 3.2.0 are affected; the exact fixed version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87946")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.