- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:21 Lisbon
In plain words
The module uses non-constant-time signature comparisons and generates predictable SAML request identifiers using non-cryptographic randomness. These weaknesses may reduce the security of SAML authentication through an external identity provider, but no practical authentication bypass has been demonstrated from them alone.
Am I affected?
Look for drupal/miniorange_saml and its installed version in composer.lock. The advisory lists 3.2.0 as fixed but gives no affected version range. Check whether your site uses the module as a SAML 2.0 Service Provider for authentication through an external identity provider; no specific configuration or database condition is named.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module uses cryptographic constructions that do not align with current security best practices.
The module performs certain signature comparisons using non constant-time comparison logic and generates SAML request identifiers using predictable values derived from non-cryptographic random number generation.
While no practical authentication bypass has been demonstrated as a result of these weaknesses alone, they may reduce the overall security margin of SAML authentication workflows.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-144
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml