- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:22 LisbonUpdated Sun 25 Oct 2026, 23:26 Lisbon
In plain words
The module stores sensitive authentication information in a way that could expose it to users who can access configuration or related system data. An attacker must first obtain access to that configuration or the underlying storage mechanisms.
Am I affected?
Look for drupal/miniorange_saml and its version in composer.lock. The advisory lists 3.2.0 as fixed but gives no affected version range. Check who can access the module's configuration, related system data or underlying storage, as disclosure requires that access.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement for an attacker to first obtain access to configuration or underlying storage mechanisms.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related system data.
This vulnerability is mitigated by the fact that an attacker must first obtain access to configuration or underlying storage mechanisms.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-149
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml