The vulnerability is an instance of Improper Neutralization of Input During Web Page Generation, classified as CWE‑79. It allows an attacker to inject malicious scripts that run in the context of the user’s browser when the affected page is rendered. This can lead to session hijacking, data theft, defacement, or downstream attacks against other users. The impact is a client‑side code execution flaw that compromises confidentiality and integrity of user sessions.

It affects the Drupal SAML SSO – Service Provider module for all releases from 0.0.0 up through 3.2.0. Administrators of sites that rely on this module for single‑sign‑on should review whether they are running a version in that range and plan to upgrade accordingly.

The CVSS score is 3.5, indicating a moderate severity for a client‑side flaw. The EPSS score is < 1%, implying a very low probability of public exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability permits cross‑site scripting, meaning that a malicious script could execute in the victim’s browser if an attacker can supply input that the module renders without proper sanitization. Because the CVE description does not specify the exact execution path, the exact attack vector remains unspecified, but the potential for session hijacking, credential theft, and other downstream impacts is inherent to XSS. The overall risk for a site running affected versions is moderate, and applying the official patch is the recommended course of action.