CVE-2026-87943 in SAML SSO
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw resides within the Drupal module for SAML Single Sign-On acting as a Service Provider, specifically affecting version ranges from 0.0.0 up through and including 3.2.0. This vulnerability is classified fundamentally as an access control failure where the application fails to enforce proper authorization checks on specific endpoints or actions exposed by the service provider component. In the context of web applications utilizing SAML for authentication, the Service Provider relies heavily on correct configuration and strict validation of incoming assertions and requests from Identity Providers. When these mechanisms are bypassed due to missing server-side authorization logic, it creates a pathway for unauthorized entities to interact with sensitive administrative functions or internal processing routines that should be restricted to authenticated administrators or specific service roles.
From a technical perspective, the core issue is categorized under CWE-284 Improper Access Control and more specifically aligns with CWE-639 Authorization Bypass Through Forceful Browsing. This type of vulnerability occurs when an application does not adequately verify that the current user has permission to perform a requested action before executing it. In this scenario, attackers can manipulate URLs or directly invoke API endpoints associated with the SAML configuration management features without possessing valid administrative credentials. The absence of these checks means that any actor who can reach the web server hosting the Drupal instance may attempt to modify critical authentication settings, such as changing entity IDs, certificate configurations, or assertion consumer service URLs. This bypasses the intended security boundary established by the login mechanism, effectively treating unauthenticated requests with the same privilege level as authenticated administrative ones for these specific endpoints.
The operational impact of this vulnerability is severe because it compromises the integrity and availability of the authentication infrastructure itself. An attacker who successfully exploits this flaw can alter the SAML configuration to redirect authentication flows or inject malicious metadata into the system. This could lead to a complete compromise of user accounts across all systems integrated with this Drupal instance via SSO. Furthermore, by modifying service provider settings, an adversary might facilitate phishing attacks where users are redirected to fake identity providers controlled by the attacker, thereby harvesting credentials from legitimate users. The ability to force browse and modify these configurations without authorization undermines trust in the entire federated identity ecosystem supported by the platform.
Mitigation strategies must prioritize immediate remediation through software updates as well as defensive architectural adjustments. The primary solution is to upgrade the SAML SSO - Service Provider module to a version later than 3.2.0, where these access control checks have been implemented and validated by the maintainers. For environments that cannot immediately patch due to compatibility constraints or other operational dependencies, temporary mitigations should include restricting direct access to administrative paths via web server configuration rules such as IP whitelisting for admin interfaces. Additionally, deploying a Web Application Firewall with specific rule sets designed to detect abnormal patterns in SAML request handling and unauthorized modification attempts can provide an additional layer of defense. Continuous monitoring of authentication logs for unusual changes to service provider configurations is also recommended to ensure rapid detection if exploitation occurs despite preventive measures.