- Package
- drupal/miniorange_saml
- Fixed in
- 3.2.0
- Published
- Wed 9 Sep 2026, 18:23 LisbonUpdated Sun 25 Oct 2026, 23:26 Lisbon
In plain words
An attacker who can configure identity provider metadata can make the module send requests to unintended destinations because it does not sufficiently validate metadata URLs. This could allow access to internal network resources.
Am I affected?
Look for drupal/miniorange_saml and its version in composer.lock. The advisory lists 3.2.0 as fixed but does not specify an affected version range. Review who has permission to configure identity provider metadata, as an attacker needs that permission to exploit the flaw.
What to do
Check which version you have, then update to a fixed release for your branch (3.2.0):
composer show drupal/miniorange_saml | grep versions
composer update drupal/miniorange_samlIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory identifies the requirement for permission to configure identity provider metadata as a mitigating factor.
The advisory's description
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.
The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity provider metadata could cause the application to make requests to unintended destinations, potentially allowing access to internal network resources.
This vulnerability is mitigated by the fact that an attacker must have permission to configure identity provider metadata.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-151
- The week's digest, with the other advisories from 7 Sep 2026
- All advisories for drupal/miniorange_saml