The Drupal SAML SSO - Service Provider module contains an observable timing discrepancy that can be exploited to perform brute‑force attacks against authentication credentials or tokens. The weakness is classified as a timing side‑channel flaw (CWE‑208) and allows an attacker to deduce valid secrets by measuring response times to repeated authentication requests.

Drupal sites that use the SAML SSO - Service Provider module with any released version numbered from 0.0.0 through 3.2.0 are impacted. The issue affects the authentication component of the SAML Service Provider integration within Drupal.

The CVSS score is 4.8, indicating moderate severity, even though the advisory labels the vulnerability as critical. EPSS score is 0.0015 (<1%) and the vulnerability is not listed in CISA’s KEV catalog, yet the advisory labels it as critical. Based on the description, it is inferred that an attacker with network access to the SAML endpoint could repeatedly send authentication attempts and monitor timing differences to guide a brute‑force enumeration. Successful exploitation would result in authentication bypass and potentially elevated privileges. The lack of a publicly documented fix increases the risk to systems that continue to use vulnerable versions.