- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:20 LisbonUpdated Sun 25 Oct 2026, 23:26 Lisbon
In plain words
The module does not properly validate TLS certificates for outbound HTTPS requests. An attacker who can intercept or redirect the site's network traffic could impersonate a trusted remote service and influence the module's communications.
Am I affected?
Look for drupal/miniorange_saml and its installed version in composer.lock. The advisory lists 3.2.0 as fixed but does not specify the affected versions. The issue concerns outbound HTTPS requests made by the module, where an attacker can intercept or redirect traffic from the site.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory identifies a mitigating factor: an attacker must be able to intercept or redirect network traffic originating from the site.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not properly validate TLS certificates when making outbound HTTPS requests.
An attacker in a position to intercept network traffic could impersonate a trusted remote service and influence communications performed by the module.
This vulnerability is mitigated by the fact that an attacker must be able to
intercept or redirect network traffic originating from the site.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-142
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml