CVE-2026-5343: SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-07-21
Weakness: CWE-754

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.

Affected products

Drupal SAML SSO - Service Provider: from 3.0.1 before 3.1.4; 7.x-1.0, 7.x-1.1, 7.x-1.2, 7.x-1.3, 7.x-1.4, 7.x-1.5 (+70) — fixed in 3.1.4

How to fix

Upgrade to a fixed version: Drupal SAML SSO - Service Provider 3.1.4. Check the vendor advisory for mitigations.

References

https://www.drupal.org/sa-contrib-2026-031

Get alerted when CVE-2026-5343 or the next vulnerability affects your stack