The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Project:
Date:
2026-September-09
Vulnerability:
Cross-site scripting
Affected versions:
<3.2.0
CVE IDs:
CVE-2026-87948
Description:
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting vulnerability (XSS).
Solution:
Install the latest version:
- Upgrade to SAML SSO - Service Provider 3.2.0.
Reported By:
Coordinated By:
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
