Live › vulnerability › CVE-2026-87953
Go to dashboardThe Drupal SAML SSO - Service Provider module contains a server-side request forgery flaw affecting versions up to and including 3.2.0. An attacker can make the Drupal server send requests to internal or arbitrary URLs of the attacker's choosing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal SAML SSO - Service Provider module at version 3.2.0 or earlier are affected. Sites that do not use this module, or run a later version, are not affected by this entry. The sources do not say which module features trigger the request path.
No product ranges from the sources yet.
saml_sso module (Drupal SAML SSO - Service Provider) with drush pm:list --filter=saml or composer show drupal/saml_ssocomposer.lock and confirm whether it is at 3.2.0 or earlier3.2.0; the sources do not name the fixed version, so check the drupal.org project pageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-87953")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.