PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87952 Drupal CVE debrief

The Drupal SAML SSO - Service Provider is vulnerable to an authentication bypass by capture-replay attack due to insufficient replay protection. This issue affects versions from 0.0.0 to 3.2.0, potentially allowing remote services with stolen credentials to bypass authentication. Defenders should assess exposure, particularly for versions before 3.2.0, and prioritize patching to prevent potential authentication bypass attacks. The vulnerability's impact includes possible unauthorized access to sensitive data and the need to verify the inventory of affected systems.

Vendor
Drupal
Product
SAML SSO - Service Provider
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for SAML SSO - Service Provider deployments, particularly those using versions before 3.2.0, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify inventory, assess potential impacts, and implement necessary mitigations.

Why it matters

Drupal SAML SSO - Service Provider insufficient replay protection vulnerability requires assessment and patching for versions before 3.2.0 to prevent potential authentication bypass attacks.

  • Potential authentication bypass by capture-replay attack
  • Possible unauthorized access to sensitive data
  • Need to verify inventory of affected systems
  • Priority patching for SAML SSO - Service Provider versions before 3.2.0

Technical summary

The Drupal SAML SSO - Service Provider is vulnerable to an authentication bypass by capture-replay attack due to insufficient replay protection. This issue affects versions from 0.0.0 to 3.2.0. The vulnerability allows attackers to potentially bypass authentication using stolen credentials. Defenders should assess exposure, verify inventory, and prioritize patching for SAML SSO - Service Provider versions before 3.2.0. The technical impact includes potential authentication bypass and unauthorized access to sensitive data.

Defensive priority

Assess exposure, verify inventory, and prioritize patching for SAML SSO - Service Provider versions before 3.2.0

Recommended defensive actions

  • Assess exposure of SAML SSO - Service Provider versions before 3.2.0
  • Verify inventory of affected systems
  • Prioritize patching for SAML SSO - Service Provider versions before 3.2.0
  • Monitor for potential authentication bypass attempts

Evidence notes

The CVE record and source item provide details on the insufficient replay protection vulnerability in Drupal SAML SSO - Service Provider. The NVD entry is currently not available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87952 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87952

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87952 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87952

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.