This vulnerability exposes hard‑coded credentials in the Drupal SAML SSO – Service Provider module, allowing an attacker to retrieve embedded sensitive data. The weakness is classified as CWE‑798 and enables disclosure of authentication secrets that should be protected, increasing the risk of further compromise. The impact is primarily the loss of confidentiality for any data that the compromised credentials protect.

The issue targets the Drupal SAML SSO – Service Provider module, affecting all released versions from 0.0.0 through 3.2.0. Users must verify whether their instance is within this range and, if so, consider it vulnerable.

The CVSS score is 5.3, indicating moderate severity. Based on the description, it is inferred that exploitation can occur remotely via the SAML interface, as the hard‑coded credentials can be accessed through standard protocol exchanges. The EPSS score is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, indicating that no public exploits are currently known. Nevertheless, the presence of embedded credentials represents a serious security flaw that should be addressed promptly.