CVE-2026-87949: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal SAML SSO - Service Provider

This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in the Drupal SAML SSO - Service Provider module. It allows an attacker to inject malicious scripts into web pages, potentially leading to Cross-Site Scripting (XSS) attacks. The affected versions are all versions from 0.0.0 up to 3.2.0. There is no information about active exploitation or a CVSS score. No patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions depending on the victim's privileges and browser context. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided, users should monitor Drupal's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, consider applying input validation or output encoding workarounds if feasible.