Drupal SAML SSO – Service Provider includes an improper neutralization of input during web page generation that allows cross‑site scripting by injecting malicious scripts into rendered pages. The vulnerability can enable attackers to hijack user sessions, deface content, and perform phishing attacks against users authenticated via SAML Single Sign‑On. Because the flaw operates at the rendering level, it can compromise the confidentiality and integrity of user data without requiring authentication bypass.

The affected product is Drupal’s SAML SSO – Service Provider module. Vulnerable releases range from the initial release (0.0.0) up to and including version 3.2.0. Any site running any of those releases is impacted.

The CVSS base score is 3.3, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can influence the content of SAML assertions or other inputs processed by the module could trigger the XSS. Exploitation would likely require sending crafted data that is reflected in the web page, but no explicit authentication bypass or privilege escalation is required.