A vulnerability in the Drupal SAML SSO Service Provider allows an attacker to capture a legitimate SAML assertion and replay it, bypassing authentication controls. This results in the attacker gaining access to services as if they possessed valid credentials, without needing to compromise the end user’s account credentials directly.

Drupal SAML SSO - Service Provider versions ranging from the initial release (0.0.0) through 3.2.0 are affected.

The CVSS score of 3.1 indicates low severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw permits remote authentication bypass by replaying a captured SAML assertion, enabling an attacker to appear as a legitimate user without acquiring credentials. Attackers can likely achieve this by intercepting or redirecting SAML traffic over the network; because no local privilege is required, exposed SAML endpoints are at risk.