- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:22 Lisbon
In plain words
The Drupal miniOrange SAML module contains embedded credentials used by its functionality. Under certain circumstances, these credentials could let an attacker obtain information about associated services. The advisory does not specify those circumstances.
Am I affected?
Look for drupal/miniorange_saml and its installed version in composer.lock. The advisory lists 3.2.0 as fixed but gives no affected version range, so it does not establish which other versions are affected. It names no specific configuration, feature setting or database to check, and does not explain the circumstances needed for disclosure.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module contains embedded credentials used by the functionality provided by the module.
Under certain circumstances, these credentials could allow information about associated services to be disclosed.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-148
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml