The Drupal SAML SSO – Service Provider module implements single sign‑on using SAML, but fails to properly validate the cryptographic signature on inbound assertions. Because the signature is not verified, an attacker can forge a SAML response and impersonate any user, gaining unauthorized authentication to the protected services. This flaw is categorized as CWE‑347 and results in a bypass of authentication, allowing full access to the application or any downstream resources that rely on the authentication session.

Drupal SAML SSO – Service Provider, versions 0.0.0 through 3.2.0. The vulnerability applies to all releases in that range for the Drupal website component that provides the SAML service‑provider functionality.

The flaw can be exploited by a remote attacker who can send a crafted assertion to the SP endpoint, bypassing authentication without needing any credentials. The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of <1% reflects a very low exploitation probability. Despite the low exploitation probability, the authentication bypass remains dangerous, and the vulnerability is not listed in the CISA KEV catalog.