PatchClock

PHP security digest · 9 Sep 2026

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...

Unrated CVE-2026-87948

Package
drupal/miniorange_saml
Fixed in
3.2.0
Published
Wed 9 Sep 2026, 18:21 LisbonUpdated Sun 25 Oct 2026, 23:25 Lisbon

In plain words

The Drupal SAML module does not sufficiently sanitise user-supplied data before displaying it in generated HTML. This can allow an attacker to run script in a user's browser when that data is displayed, causing cross-site scripting (XSS).

Am I affected?

Look for drupal/miniorange_saml and its version in composer.lock. The advisory lists 3.2.0 as fixed but gives no affected version range, so it does not establish which other versions are affected. It names no specific configuration, feature setting or database condition, so the package version is all there is to check.

What to do

Check which version you have, then update to a fixed release for your branch (3.2.0):

composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_saml

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting vulnerability (XSS).

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.