DRUPAL-CONTRIB-2026-144

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-144.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-144
Aliases
  • CVE-2026-87946
Published
2026-09-09T17:21:01Z
Modified
2026-09-09T19:25:59Z
Summary
[none]
Details

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module uses cryptographic constructions that do not align with current security best practices.

The module performs certain signature comparisons using non constant-time comparison logic and generates SAML request identifiers using predictable values derived from non-cryptographic random number generation.

While no practical authentication bypass has been demonstrated as a result of these weaknesses alone, they may reduce the overall security margin of SAML authentication workflows.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/miniorange_saml

Package

Name
drupal/miniorange_saml
Purl
pkg:composer/drupal/miniorange_saml?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.0
Database specific
Show details 
{
    "constraint": "<3.2.0"
}

Database specific

affected_versions 
"<3.2.0"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-144.json"