SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

Project: SAML SSO - Service Provider Date: 2026-February-25Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: <3.1.3CVE IDs: CVE-2026-3217Description: This module enables you to perform SAML protocol-based single sign-on (SSO) on a Drupal site.
The module doesn't sufficiently sanitize user input, leading to a reflected Cross-site scripting (XSS) vulnerability.Solution: Install the latest version:

• If you are using the "SAML SSO- Service Provider" module for Drupal, upgrade to SAML SSO- Service Provider 3.1.3.

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Sudhanshu Dhage (sudhanshu0542)

Coordinated By: 

• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team