- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:20 Lisbon
In plain words
The module does not sufficiently validate some user-supplied URLs before redirecting users. An attacker could send users to an external website after authentication, which could support phishing or make malicious links appear more credible.
Am I affected?
Look for drupal/miniorange_saml and its version in composer.lock. The advisory lists 3.2.0 as fixed but gives no affected version range. It names no configuration or database condition to check beyond the package version; the redirect happens after authentication.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The miniorange_saml module does not sufficiently validate certain user-supplied URLs before performing redirects.
An attacker could cause users to be redirected to an external website after authentication. This could be used in phishing attacks or to increase the credibility of malicious links.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-143
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml