SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
Priority LOW 34CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed SAML SSO - Service Provider (Drupal): 3.1.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Drupal | SAML SSO - Service Provider | 0.0.0 to before 3.1.4 | 3.1.4 | Patch available | CNA |
- SAML SSO - Service Provider VendorDrupal Affected 0.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available CNA
CPE configurations NVD · 77
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:*:*:*:*:*:drupal:*:* | 3.0.1 to before 3.1.4 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.0:*:*:*:*:drupal:*:* | 7.x-1.0 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.1:*:*:*:*:drupal:*:* | 7.x-1.1 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.2:*:*:*:*:drupal:*:* | 7.x-1.2 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.3:*:*:*:*:drupal:*:* | 7.x-1.3 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.4:*:*:*:*:drupal:*:* | 7.x-1.4 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.5:*:*:*:*:drupal:*:* | 7.x-1.5 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.6:*:*:*:*:drupal:*:* | 7.x-1.6 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.7:*:*:*:*:drupal:*:* | 7.x-1.7 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.8:*:*:*:*:drupal:*:* | 7.x-1.8 | Vulnerable | miniOrange |
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:*:*:*:*:*:drupal:*:* Versions 3.0.1 to before 3.1.4 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.0:*:*:*:*:drupal:*:* Versions 7.x-1.0 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.1:*:*:*:*:drupal:*:* Versions 7.x-1.1 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.2:*:*:*:*:drupal:*:* Versions 7.x-1.2 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.3:*:*:*:*:drupal:*:* Versions 7.x-1.3 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.4:*:*:*:*:drupal:*:* Versions 7.x-1.4 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.5:*:*:*:*:drupal:*:* Versions 7.x-1.5 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.6:*:*:*:*:drupal:*:* Versions 7.x-1.6 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.7:*:*:*:*:drupal:*:* Versions 7.x-1.7 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.8:*:*:*:*:drupal:*:* Versions 7.x-1.8 Vulnerable ·miniOrange
Show 67 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.9:*:*:*:*:drupal:*:* | 7.x-1.9 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.91:*:*:*:*:drupal:*:* | 7.x-1.91 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.92:*:*:*:*:drupal:*:* | 7.x-1.92 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.93:*:*:*:*:drupal:*:* | 7.x-1.93 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.94:*:*:*:*:drupal:*:* | 7.x-1.94 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.95:*:*:*:*:drupal:*:* | 7.x-1.95 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.96:*:*:*:*:drupal:*:* | 7.x-1.96 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.97:*:*:*:*:drupal:*:* | 7.x-1.97 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.98:*:*:*:*:drupal:*:* | 7.x-1.98 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.99:*:*:*:*:drupal:*:* | 7.x-1.99 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.991:*:*:*:*:drupal:*:* | 7.x-1.991 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.992:*:*:*:*:drupal:*:* | 7.x-1.992 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.993:*:*:*:*:drupal:*:* | 7.x-1.993 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.994:*:*:*:*:drupal:*:* | 7.x-1.994 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.995:*:*:*:*:drupal:*:* | 7.x-1.995 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.0:*:*:*:*:drupal:*:* | 7.x-2.0 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.1:*:*:*:*:drupal:*:* | 7.x-2.1 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.2:*:*:*:*:drupal:*:* | 7.x-2.2 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.3:*:*:*:*:drupal:*:* | 7.x-2.3 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.4:*:*:*:*:drupal:*:* | 7.x-2.4 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.5:*:*:*:*:drupal:*:* | 7.x-2.5 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.51:*:*:*:*:drupal:*:* | 7.x-2.51 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.52:*:*:*:*:drupal:*:* | 7.x-2.52 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.53:*:*:*:*:drupal:*:* | 7.x-2.53 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.54:*:*:*:*:drupal:*:* | 7.x-2.54 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.55:*:*:*:*:drupal:*:* | 7.x-2.55 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.56:*:*:*:*:drupal:*:* | 7.x-2.56 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.60:*:*:*:*:drupal:*:* | 7.x-2.60 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.61:*:*:*:*:drupal:*:* | 7.x-2.61 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.70:*:*:*:*:drupal:*:* | 7.x-2.70 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.71:*:*:*:*:drupal:*:* | 7.x-2.71 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.72:*:*:*:*:drupal:*:* | 7.x-2.72 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.0:*:*:*:*:drupal:*:* | 8.x-1.0 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.1:*:*:*:*:drupal:*:* | 8.x-1.1 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.2:*:*:*:*:drupal:*:* | 8.x-1.2 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.3:*:*:*:*:drupal:*:* | 8.x-1.3 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.4:*:*:*:*:drupal:*:* | 8.x-1.4 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.5:*:*:*:*:drupal:*:* | 8.x-1.5 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.6:*:*:*:*:drupal:*:* | 8.x-1.6 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.7:*:*:*:*:drupal:*:* | 8.x-1.7 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.8:*:*:*:*:drupal:*:* | 8.x-1.8 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.9:*:*:*:*:drupal:*:* | 8.x-1.9 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.10:*:*:*:*:drupal:*:* | 8.x-1.10 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.11:*:*:*:*:drupal:*:* | 8.x-1.11 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.12:*:*:*:*:drupal:*:* | 8.x-1.12 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.121:*:*:*:*:drupal:*:* | 8.x-1.121 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.122:*:*:*:*:drupal:*:* | 8.x-1.122 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.0:*:*:*:*:drupal:*:* | 8.x-2.0 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.1:*:*:*:*:drupal:*:* | 8.x-2.1 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.11:*:*:*:*:drupal:*:* | 8.x-2.11 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.12:*:*:*:*:drupal:*:* | 8.x-2.12 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.13:*:*:*:*:drupal:*:* | 8.x-2.13 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.14:*:*:*:*:drupal:*:* | 8.x-2.14 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.15:*:*:*:*:drupal:*:* | 8.x-2.15 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.16:*:*:*:*:drupal:*:* | 8.x-2.16 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.17:*:*:*:*:drupal:*:* | 8.x-2.17 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.18:*:*:*:*:drupal:*:* | 8.x-2.18 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.19:*:*:*:*:drupal:*:* | 8.x-2.19 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.20:*:*:*:*:drupal:*:* | 8.x-2.20 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.21:*:*:*:*:drupal:*:* | 8.x-2.21 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.22:*:*:*:*:drupal:*:* | 8.x-2.22 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.23:*:*:*:*:drupal:*:* | 8.x-2.23 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.24:*:*:*:*:drupal:*:* | 8.x-2.24 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.25:*:*:*:*:drupal:*:* | 8.x-2.25 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.26:*:*:*:*:drupal:*:* | 8.x-2.26 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.27:*:*:*:*:drupal:*:* | 8.x-2.27 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.28:*:*:*:*:drupal:*:* | 8.x-2.28 | Vulnerable | miniOrange |
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.9:*:*:*:*:drupal:*:* Versions 7.x-1.9 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.91:*:*:*:*:drupal:*:* Versions 7.x-1.91 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.92:*:*:*:*:drupal:*:* Versions 7.x-1.92 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.93:*:*:*:*:drupal:*:* Versions 7.x-1.93 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.94:*:*:*:*:drupal:*:* Versions 7.x-1.94 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.95:*:*:*:*:drupal:*:* Versions 7.x-1.95 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.96:*:*:*:*:drupal:*:* Versions 7.x-1.96 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.97:*:*:*:*:drupal:*:* Versions 7.x-1.97 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.98:*:*:*:*:drupal:*:* Versions 7.x-1.98 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.99:*:*:*:*:drupal:*:* Versions 7.x-1.99 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.991:*:*:*:*:drupal:*:* Versions 7.x-1.991 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.992:*:*:*:*:drupal:*:* Versions 7.x-1.992 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.993:*:*:*:*:drupal:*:* Versions 7.x-1.993 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.994:*:*:*:*:drupal:*:* Versions 7.x-1.994 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-1.995:*:*:*:*:drupal:*:* Versions 7.x-1.995 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.0:*:*:*:*:drupal:*:* Versions 7.x-2.0 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.1:*:*:*:*:drupal:*:* Versions 7.x-2.1 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.2:*:*:*:*:drupal:*:* Versions 7.x-2.2 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.3:*:*:*:*:drupal:*:* Versions 7.x-2.3 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.4:*:*:*:*:drupal:*:* Versions 7.x-2.4 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.5:*:*:*:*:drupal:*:* Versions 7.x-2.5 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.51:*:*:*:*:drupal:*:* Versions 7.x-2.51 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.52:*:*:*:*:drupal:*:* Versions 7.x-2.52 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.53:*:*:*:*:drupal:*:* Versions 7.x-2.53 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.54:*:*:*:*:drupal:*:* Versions 7.x-2.54 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.55:*:*:*:*:drupal:*:* Versions 7.x-2.55 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.56:*:*:*:*:drupal:*:* Versions 7.x-2.56 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.60:*:*:*:*:drupal:*:* Versions 7.x-2.60 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.61:*:*:*:*:drupal:*:* Versions 7.x-2.61 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.70:*:*:*:*:drupal:*:* Versions 7.x-2.70 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.71:*:*:*:*:drupal:*:* Versions 7.x-2.71 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:7.x-2.72:*:*:*:*:drupal:*:* Versions 7.x-2.72 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.0:*:*:*:*:drupal:*:* Versions 8.x-1.0 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.1:*:*:*:*:drupal:*:* Versions 8.x-1.1 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.2:*:*:*:*:drupal:*:* Versions 8.x-1.2 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.3:*:*:*:*:drupal:*:* Versions 8.x-1.3 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.4:*:*:*:*:drupal:*:* Versions 8.x-1.4 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.5:*:*:*:*:drupal:*:* Versions 8.x-1.5 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.6:*:*:*:*:drupal:*:* Versions 8.x-1.6 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.7:*:*:*:*:drupal:*:* Versions 8.x-1.7 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.8:*:*:*:*:drupal:*:* Versions 8.x-1.8 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.9:*:*:*:*:drupal:*:* Versions 8.x-1.9 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.10:*:*:*:*:drupal:*:* Versions 8.x-1.10 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.11:*:*:*:*:drupal:*:* Versions 8.x-1.11 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.12:*:*:*:*:drupal:*:* Versions 8.x-1.12 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.121:*:*:*:*:drupal:*:* Versions 8.x-1.121 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-1.122:*:*:*:*:drupal:*:* Versions 8.x-1.122 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.0:*:*:*:*:drupal:*:* Versions 8.x-2.0 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.1:*:*:*:*:drupal:*:* Versions 8.x-2.1 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.11:*:*:*:*:drupal:*:* Versions 8.x-2.11 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.12:*:*:*:*:drupal:*:* Versions 8.x-2.12 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.13:*:*:*:*:drupal:*:* Versions 8.x-2.13 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.14:*:*:*:*:drupal:*:* Versions 8.x-2.14 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.15:*:*:*:*:drupal:*:* Versions 8.x-2.15 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.16:*:*:*:*:drupal:*:* Versions 8.x-2.16 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.17:*:*:*:*:drupal:*:* Versions 8.x-2.17 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.18:*:*:*:*:drupal:*:* Versions 8.x-2.18 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.19:*:*:*:*:drupal:*:* Versions 8.x-2.19 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.20:*:*:*:*:drupal:*:* Versions 8.x-2.20 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.21:*:*:*:*:drupal:*:* Versions 8.x-2.21 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.22:*:*:*:*:drupal:*:* Versions 8.x-2.22 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.23:*:*:*:*:drupal:*:* Versions 8.x-2.23 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.24:*:*:*:*:drupal:*:* Versions 8.x-2.24 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.25:*:*:*:*:drupal:*:* Versions 8.x-2.25 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.26:*:*:*:*:drupal:*:* Versions 8.x-2.26 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.27:*:*:*:*:drupal:*:* Versions 8.x-2.27 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sso_-_service_provider:8.x-2.28:*:*:*:*:drupal:*:* Versions 8.x-2.28 Vulnerable ·miniOrange
Remediation
- Fix · CNA SAML SSO - Service Provider (Drupal) Fixed in 3.1.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5343
- 2026-10-03 Alias added: GHSA-9622-2jm8-94x7
References
More Drupal vulnerabilities
- TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
- TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
- TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2026-5343 · CVE Program
- CVE-2026-5343 · NVD
- FIRST EPSS
- GHSA-9622-2jm8-94x7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences