Single sign-on is supposed to be the trustworthy adult in the room — the module that quietly proves you are who you say you are. This week, Drupal's SAML SSO module needed a security intervention of its own, and it wasn't alone.
20 Advisories, 11 of Them One Module
The Drupal Security Team published 20 contributed-project security advisories on September 9, with nine rated Critical and eleven Moderately Critical. Eleven of the twenty — more than half the batch — hit a single module: SAML SSO - Service Provider, the tool many Drupal sites lean on for enterprise login.
The issues ranged from weak cryptographic practices (non constant-time signature comparisons and predictable SAML request IDs, rated Critical under CVE-2026-87946) to cross-site scripting from unsanitized SAML assertion data, improper access control on admin-only functionality, insufficient replay protection letting a valid assertion be reused, and server-side request forgery from unvalidated identity-provider metadata URLs. All eleven are fixed in version 3.2.0.
One Weak Link, Total Authentication Bypass
SAML SSO modules sit at the front door of a site's authentication system — get one wrong and you're not looking at a defaced page, you're looking at an attacker walking straight past the login screen. Replay protection and weak randomness sound like abstract cryptography footnotes right up until someone uses them to forge a valid session.
The detail worth sitting with: this is eleven separate flaws in one authentication module, disclosed the same day. That's not one oversight, it's a pattern — the kind of thing that happens when a security-critical module doesn't get the scrutiny its job title demands.
If SAML SSO - Service Provider is running anywhere in your stack below 3.2.0, that update jumps to the top of today's list, no exceptions.
Patching a module is the easy part — knowing which of your dozens of contrib modules are quietly carrying this kind of risk is the hard part, and it's exactly what our Drupal security audits are built to catch: let's get your site checked.
Source: The DropTimes