- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:21 Lisbon
In plain words
An attacker can influence which signature algorithm the module uses to validate a SAML assertion, rather than having it tied to the configured Identity Provider (IdP) key type. This requires the attacker to be able to submit a crafted SAML response to the affected Drupal site.
Am I affected?
Look for drupal/miniorange_saml and its installed version in composer.lock. Check whether your site uses the module as a SAML 2.0 Service Provider to authenticate users through an external IdP. Version 3.2.0 is listed as fixed, but the advisory supplies no affected version range, so it does not establish which other versions are affected.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory identifies one mitigating condition: an attacker must be able to submit a crafted SAML response to the affected site.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced by the incoming response rather than being tied to the type of key configured for the Identity Provider (IdP).
The vulnerability is mitigated by the fact that an attacker must be able to submit a crafted SAML response to the affected site.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-145
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml