---
id: "CVE-2026-87946"
kind: "vulnerability"
aliases: ["CVE-2026-87946"]
title: "Drupal SAML SSO: timing difference lets attackers brute force logins"
severity: "medium"
cvss: 4.8
epss: 0.00177
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "saml", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:04+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:33:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87946", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87946", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal SAML SSO: timing difference lets attackers brute force logins

The Drupal SAML SSO Service Provider module leaks timing differences that reveal information about its checks. An attacker can use this timing signal to brute force credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Drupal SAML SSO - Service Provider module with `drush pm:list --filter=saml` or by reading the module's `composer.lock` entry.
- Confirm whether the module is enabled on the site with `drush pm:list --status=enabled --filter=saml`.

## Fix

- Upgrade the Drupal SAML SSO - Service Provider module to a version later than `3.2.0`, as the sources say versions from 0.0.0 to 3.2.0 are affected; the exact fixed version is unknown.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87946
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87946

## From the sources

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider  allows Brute Force. This issue affects SAML SSO - Service Provider  versions: from 0.0.0 to 3.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_