PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87948 Drupal CVE debrief

A cross-site scripting (XSS) vulnerability exists in the SAML SSO - Service Provider module for Drupal, affecting versions from 0.0.0 to 3.2.0. This issue allows attackers to inject malicious scripts into web pages, potentially leading to security breaches. The vulnerability has been publicly disclosed and is considered moderately critical. Defenders should be aware of the potential for security breaches or unauthorized access if user authentication or authorization is critical. The vulnerability is caused by improper neutralization of input during web page generation.

Vendor
Drupal
Product
SAML SSO - Service Provider
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for securing Drupal installations, particularly those using the SAML SSO - Service Provider module, should be aware of this vulnerability and take steps to mitigate or patch it.

Why it matters

CVE-2026-87948 is a moderately critical cross-site scripting (XSS) vulnerability in the SAML SSO - Service Provider module for Drupal. Defenders should prioritize patching or mitigating this issue, especially in environments where user authentication or authorization is critical, as it could lead to security breaches or unauthorized access.

  • Potential injection of malicious scripts into web pages
  • Possible security breaches or unauthorized access
  • Need for input validation and sanitization
  • Priority for patching or upgrading affected versions

Technical summary

The SAML SSO - Service Provider module for Drupal is vulnerable to cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 3.2.0. The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to security breaches or unauthorized access. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where user authentication or authorization is critical.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where user authentication or authorization is critical.

Recommended defensive actions

  • Patch or upgrade the SAML SSO - Service Provider module to version 3.2.0 or later
  • Implement input validation and sanitization for user-supplied data
  • Monitor for suspicious activity or anomalies in user behavior

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The affected product is SAML SSO - Service Provider, and the issue is caused by improper neutralization of input during web page generation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87948 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87948

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87948 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87948

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.