CVE-2026-87946: CWE-208 Observable Timing Discrepancy in Drupal SAML SSO - Service Provider

CVE-2026-87946 describes a timing discrepancy vulnerability (CWE-208) in the Drupal SAML SSO - Service Provider module. This flaw allows attackers to observe timing differences in the authentication process, which can be leveraged to conduct brute force attacks against the service. The affected versions range from the initial release (0.0.0) up to version 3.2.0, which is not affected. No CVSS score or detailed exploit information is provided.

The vulnerability enables attackers to perform brute force attacks by exploiting timing discrepancies in the SAML SSO authentication process. This could potentially allow unauthorized access if brute force attempts succeed. There are no known exploits in the wild at this time.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the Drupal vendor advisory for current remediation guidance. Until a fix is available, consider monitoring authentication attempts for unusual activity related to brute force.