Single Sign-On is supposed to make logging in feel effortless and secure at the same time. This week, the "secure" part took a hit: Drupal's Security Team dropped eleven advisories against a single SAML SSO module in one batch, four of them rated Critical. That's not a bad day — that's a bad month, compressed into one disclosure.

Eleven Advisories, One Very Tired Module Maintainer

On September 9, 2026, the Drupal Security Team published 20 contributed-project advisories in a single batch, and the SAML SSO - Service Provider module accounted for eleven of them, spanning CVE-2026-87943 through CVE-2026-87946 and beyond. The Critical-rated flaws include non-constant-time signature comparisons, an open redirect, improper TLS certificate validation, and improper access control — a genuine grab bag of "how did all of these end up in one authentication module."

This landed just a week after another batch of 16 contributed-project advisories on September 2, five of them Critical, covering unrelated modules like Ultimate Table Field and Taxonomy Term Glossary with access-bypass issues of their own.

Your SSO Module Is the Front Door, Not a Side Panel

A SAML module isn't some optional add-on — it's the thing standing between "anyone on the internet" and "logged in as your site admin." Non-constant-time signature comparisons sound like an academic nitpick until you realize they're exactly the kind of timing-attack vector that lets a patient adversary forge a valid login assertion.

The real lesson here isn't "this one module is bad," it's that authentication code is disproportionately unforgiving of small mistakes — a bug that would be a shrug in a blog-comment module becomes a full account takeover in an SSO handler. Drupal's security process caught it and disclosed it fast, which is the system working as intended. Whether your site's maintainer applied the patch is a separate question entirely.

Open source security only works if someone's actually watching the advisories roll in — and applying them before a "moderately critical" becomes "moderately compromised."

If auditing your Drupal site's module list against active security advisories sounds like a chore you've been putting off, that's precisely the kind of unglamorous work WTK handles for clients — reach out and let's get your stack checked.

Source: Drupal.org Security Advisories