Single sign-on is supposed to be the thing that makes your life easier — one login, one password, one fewer thing to worry about. Drupal's SAML SSO - Service Provider module apparently decided "one fewer thing to worry about" was a personal challenge, racking up eleven separate security advisories in a single disclosure batch.
Eleven Advisories, One Very Busy Patch Note
On September 9, 2026, the Drupal Security Team published 20 contributed-project advisories — nine critical, eleven moderately critical — and eleven of them belonged to the miniorange_saml module alone. The critical issues include improper access control, improper certificate validation, an open redirect, and weak cryptographic practices, the last of which involved comparing security signatures using non-constant-time logic and generating request IDs with predictable, non-cryptographic randomness.
The moderately critical pile added an authentication bypass, two cross-site scripting bugs, embedded credentials, information disclosure, insufficient replay protection, and server-side request forgery. Every single one of the eleven flaws is fixed in version 3.2.0.
Why a Login Module Matters More Than Most
SAML modules sit at the front door of enterprise identity — they're the thing deciding who gets to walk in as an admin. An open redirect or a predictable request ID sounds abstract until you realize it's the difference between "employee logs into intranet" and "attacker logs in as employee."
This is also a tidy reminder that Drupal core being rock-solid doesn't mean your whole stack is. Most real-world breaches happen in the sprawling contrib module ecosystem, not core — which is exactly why nobody should be running a two-year-old SAML integration without checking the advisory feed.
If your identity provider module hasn't seen a version bump since the last time you checked, congratulations — you now have homework.
Running SAML SSO or any identity-adjacent module on your Drupal site? James and the WTK team do exactly this kind of module audit — reach out before an old dependency becomes your incident report.
Source: Drupal.org Security Advisories