- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:23 LisbonUpdated Sun 25 Oct 2026, 23:25 Lisbon
In plain words
The module does not sufficiently prevent reuse of SAML assertions it has already accepted. An attacker who obtains a valid assertion may, under certain circumstances, reuse it before it expires, potentially making repeated authentication attempts with the same assertion.
Am I affected?
Check composer.lock for drupal/miniorange_saml and its version. Check whether your site uses the module as a SAML 2.0 Service Provider to authenticate users through an external identity provider. The advisory lists 3.2.0 as fixed but does not specify the affected version range.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The risk is limited by the attacker needing to obtain a valid SAML assertion first and only being able to reuse it during its validity period.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be replayed within its validity period, potentially allowing repeated authentication attempts using the same assertion.
This vulnerability is mitigated by the fact that an attacker must first obtain a valid SAML assertion and can only reuse it during the assertion's validity period.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-150
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml