DRUPAL-CONTRIB-2021-036
This module provides a solution to authenticate visitors using existing SAML providers.
Certain non-default configurations allow a malicious user to login as any chosen user.
The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".
What each source reports
OSVNo score
This module provides a solution to authenticate visitors using existing SAML providers.
Certain non-default configurations allow a malicious user to login as any chosen user.
The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".
- Record
DRUPAL-CONTRIB-2021-036- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/miniorange_samlPackagist:https://packages.drupal.org/8 | before 2.24.0 | 2.24.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2021-036 is a vulnerability with no CVSS score yet in drupal/miniorange_saml, published September 22, 2021. No source lists public exploit code. Fixed in drupal/miniorange_saml 2.24.0.