PT-2026-29675 · Drupal+3 · Saml Sso - Service Provider+2

Damien Mckenna + 4 · CVE-2026-5343 · Published 2026-04-01 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.1.3

Description This module enables SAML-protocol-based single-sign-on (SSO) on a Drupal site. An improper check for unusual or exceptional conditions allows for an authentication bypass, which can lead to privilege escalation.

Recommendations Update to version 3.1.4.

Exploit

Fix

LPE

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-5343

DRUPAL-CONTRIB-2026-031

Affected Products

Saml Sso - Service Provider

Miniorange Drupal Saml Sp

Miniorange Saml

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5343.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5343 · Security Note
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-031 · Vendor Advisory
• https://drupal.org/sa-contrib-2026-031 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5343 · Vendor Advisory
• https://drupal.org/project/miniorange_saml · Note
• https://git.drupalcode.org/project/miniorange_saml · Note
• https://t.me/cveNotify/208577 · Telegram Post