Drupal SAML SSO - Service Provider has a flaw where it fails to properly validate the certificate presented by an identity provider during SAML assertions. This weakness means an attacker able to position themselves between the service provider and the identity provider can present a forged certificate, causing the service provider to accept malicious SAML responses. The result is that truthfully authenticated users could be impersonated or redirected to attacker‑controlled destinations, compromising authentication integrity and confidentiality.

The vulnerability affects the Drupal SAML SSO - Service Provider module, specifically all versions from 0.0.0 up to and including 3.2.0. Organizations running any of these releases should verify their installed version and consider updating when a patch is released.

The EPSS score is <1%, and the CVSS score is 4.8. The vulnerability is not listed in CISA KEV. The flaw requires remote access to the service provider’s SAML endpoint and an attacker who can control the identity provider connection. With no explicit countermeasures published, the risk remains elevated for environments that rely on trust relationships for authentication.