CVE-2026-87952 in SAML SSO Plugin
Summary
by MITRE • 10/22/2026
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability represents a critical authentication bypass within the SAML Single Sign-On (SSO) Service Provider module for Drupal, specifically affecting version ranges from 0.0.0 through 3.2.0. This flaw stems from an insufficient validation of security tokens during the assertion consumption phase of the SAML protocol implementation. In a standard SAML authentication flow, the Identity Provider issues a signed and potentially encrypted XML Assertion to the Service Provider, which then validates this assertion before granting access to the user. However, in the affected versions, the module fails to adequately verify that each received assertion has been used only once or is bound strictly to its intended session context. This lack of robust nonce validation and timestamp enforcement creates a window where an attacker can intercept valid authentication assertions transmitted between the Identity Provider and the Drupal instance.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically manifesting as a failure to enforce unique session identifiers or assertion uniqueness checks. The core issue lies in the module's reliance on basic XML signature verification without implementing comprehensive replay protection mechanisms such as strict timestamp window validation or persistent nonce tracking within the user session state. When an attacker captures a valid SAML Assertion via network sniffing, typically through man-in-the-middle attacks on unencrypted HTTP connections or compromised internal networks, they can reuse this assertion to impersonate the original user. The Service Provider accepts the reused assertion as legitimate because it does not maintain sufficient state to detect that the token has already been processed for a different session or time window.
The operational impact of this vulnerability is severe, enabling remote attackers with network access to perform credential replay attacks without needing to crack passwords or exploit additional software flaws. Once an attacker captures a valid authentication assertion, they can inject it into their own browser session to gain unauthorized administrative or user-level access to the Drupal application. This effectively bypasses all other security controls including password policies and multi-factor authentication if those are tied to the initial SAML login event rather than subsequent actions. The attack vector is classified under MITRE ATT&CK technique T1550, specifically Sub-technique 2: Use Alternate Authentication Credentials, as it involves leveraging stolen or intercepted credentials to gain access. Furthermore, because Drupal often serves as a content management system with varying levels of user privileges, this bypass can lead to full site compromise if the targeted account possesses administrative rights.
Mitigation strategies must focus on immediate remediation and network-level hardening. The primary recommendation is to upgrade the SAML SSO - Service Provider module to version 3.2.1 or later, where developers have implemented stricter validation logic for assertion uniqueness and timestamp constraints. Until an update can be applied, administrators should enforce HTTPS across all communication channels between clients, Drupal servers, and Identity Providers to prevent network-level interception of assertions. Additionally, configuring the Identity Provider to issue short-lived tokens with tight validity windows reduces the time frame available for replay attacks. Implementing session fixation protections on the Drupal side by regenerating session IDs upon successful authentication can also mitigate some risks associated with token reuse. Regular auditing of SAML logs for duplicate assertion consumption attempts should be established to detect ongoing exploitation efforts in real-time.