{"id":"CVE-2026-87946","kind":"vulnerability","aliases":["CVE-2026-87946"],"related":[],"title":"Drupal SAML SSO: timing difference lets attackers brute force logins","description":"Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider  allows Brute Force. This issue affects SAML SSO - Service Provider  versions: from 0.0.0 to 3.2.0.","summary":"The Drupal SAML SSO Service Provider module leaks timing differences that reveal information about its checks. An attacker can use this timing signal to brute force credentials.","severity":"medium","cvss":4.8,"epss":0.00177,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","saml","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the Drupal SAML SSO - Service Provider module with `drush pm:list --filter=saml` or by reading the module's `composer.lock` entry.\n- Confirm whether the module is enabled on the site with `drush pm:list --status=enabled --filter=saml`.","fix":"- Upgrade the Drupal SAML SSO - Service Provider module to a version later than `3.2.0`, as the sources say versions from 0.0.0 to 3.2.0 are affected; the exact fixed version is unknown.","status":"open","published_at":"2026-10-22T02:17:04+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:33:09+00:00","updated_at":"2026-10-25T04:33:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:33:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal SAML SSO - Service Provider module to a version later than `3.2.0`, as the sources say versions from 0.0.0 to 3.2.0 are affected; the exact fixed version is unknown.","reach":"internet","title":"Drupal SAML SSO: timing difference lets attackers brute force logins","impact":"medium","summary":"The Drupal SAML SSO Service Provider module leaks timing differences that reveal information about its checks. An attacker can use this timing signal to brute force credentials.","category":"package","nicknames":[],"who_cares":["drupal","saml","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker brute forces SAML-protected login credentials using timing differences.","analyst_note":"Check the Drupal security advisory for the fixed version and exact trigger conditions; the NVD entry gives only the affected range.","how_to_check":"- Check the installed version of the Drupal SAML SSO - Service Provider module with `drush pm:list --filter=saml` or by reading the module's `composer.lock` entry.\n- Confirm whether the module is enabled on the site with `drush pm:list --status=enabled --filter=saml`.","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the SAML SSO - Service Provider module at version 3.2.0 or earlier are exposed. The sources do not describe which configurations are required to trigger the timing signal. Sites without this module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3341,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87946':13A,16A '0.0.0':72C '3.2.0':74C 'affect':65C 'allow':60C 'attack':7A,40B 'brute':8A,47B,61C 'check':38B 'credenti':49B 'cve':11A,14A 'differ':5A,32B 'discrep':52C 'drupal':1A,17B,24B,55C 'forc':9A,48B,62C 'host':22B 'inform':35B 'issu':64C 'leak':30B 'let':6A 'login':10A 'modul':29B 'observ':50C 'packag':18B 'provid':28B,59C,69C 'reveal':34B 'saml':2A,19B,25B,56C,66C 'self':21B 'self-host':20B 'servic':27B,58C,68C 'signal':45B 'sso':3A,26B,57C,67C 'time':4A,31B,44B,51C 'use':42B 'version':70C 'vulner':53C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the SAML SSO - Service Provider module at version 3.2.0 or earlier are exposed. The sources do not describe which configurations are required to trigger the timing signal. Sites without this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87946","severity":null,"published_at":"2026-10-22T02:17:04+00:00","modified_at":"2026-10-22T17:17:00+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87946","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87946","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}