Drupal SAML SSO - Service Provider contains a URL redirection flaw that allows an attacker to craft a link that directs users to an arbitrary, untrusted site. When users click the malicious link, they are taken to a phishing page or other malicious destination, thereby exposing credentials or enabling further attacks. This weakness is classified as a CWE‑601 Open Redirect issue.

The vulnerability affects the Drupal SAML SSO - Service Provider module in every release from version 0.0.0 up through 3.2.0. Any system using these versions of the module is susceptible to the redirection flaw.

The attack vector is remote and requires a crafted URL that the user will click, making exploitation largely user‑dependent. The EPSS score of 0.00142 indicates a very low exploitation probability, yet the absence of a publicly known exploit does not reduce the potential impact; a successful redirect can facilitate phishing, credential replay, or session hijacking. The CVSS score is 5.4, indicating a medium severity level in the moderate range, yet the potential for credential theft remains significant.