Live › vulnerability › CVE-2026-87952
Go to dashboardThe Drupal SAML SSO - Service Provider module has a capture-replay authentication bypass affecting versions up to and including 3.2.0. An attacker who has captured valid SAML authentication messages can replay them to log in to remote services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier that use it for single sign-on. Sites without this module, or not using SAML single sign-on, are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87952")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.