Live › vulnerability › CVE-2026-87947
Go to dashboardThe Drupal SAML SSO - Service Provider module does not properly verify SAML response signatures, allowing signature spoofing. An attacker who can forge a signed-looking SAML response may be able to log in as another user, though the sources do not state the exact outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier that use it for single sign-on. Sites that do not use SAML single sign-on through this module are not affected.
No product ranges from the sources yet.
drush pm:list --filter=saml or by reviewing composer show drupal/saml3.2.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87947")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.