Live › vulnerability › CVE-2026-87951
Go to dashboardThe Drupal SAML SSO - Service Provider module stores sensitive information insecurely, so data embedded in its storage can be retrieved. The sources say the affected versions run from 0.0.0 to 3.2.0 and do not describe which data or how it is reached.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier. The sources do not state which data is exposed or whether a fixed version exists, so a site owner should check the module's release page before deciding. Sites without this module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=saml and compare it to the affected range up to 3.2.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87951")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.