- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:22 Lisbon
In plain words
The module does not sufficiently sanitise some values from SAML assertions before displaying them to users, allowing cross-site scripting (XSS). This can be triggered by a malicious identity provider or an attacker able to supply crafted SAML attributes.
Am I affected?
Look for drupal/miniorange_saml and its version in composer.lock. The advisory lists 3.2.0 as fixed but does not give an affected version range. Check whether your site uses the module for SAML authentication through an external identity provider and displays values derived from SAML assertions to users.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provider or an attacker able to supply crafted SAML attributes, leading to a cross-site scripting (XSS) vulnerability.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-147
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml