CVE-2026-87952: CWE-294 Authentication Bypass by Capture-replay in Drupal SAML SSO - Service Provider

This vulnerability, identified as CWE-294 (Authentication Bypass), exists in the Drupal SAML SSO - Service Provider module. It enables an attacker who has obtained stolen credentials to bypass authentication by replaying captured authentication data. The affected versions range from the initial release (0.0.0) through all versions prior to 3.2.0. No CVSS score or detailed exploit information is provided, and no known exploits are reported in the wild.

An attacker with stolen credentials can bypass authentication controls, potentially gaining unauthorized access to services protected by the Drupal SAML SSO - Service Provider module. This could lead to unauthorized remote service access. The absence of known exploits suggests this is a theoretical or newly discovered vulnerability.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider restricting access to affected services and monitoring for suspicious authentication attempts involving the SAML SSO module.