A Server‑Side Request Forgery vulnerability (CWE‑918) exists in the Drupal SAML SSO – Service Provider module. The flaw allows an attacker to trick the server into making arbitrary HTTP requests on the server’s behalf, potentially exposing internal network resources or external services. This can lead to information disclosure or credential theft, depending on the target endpoints, and constitutes a serious breach of confidentiality and integrity.

Drupal SAML SSO – Service Provider releases from version 0.0.0 through 3.2.0 are affected. Systems running any of these versions are susceptible; newer releases beyond 3.2.0 are not listed as vulnerable.

The attack vector is inferred to be remote because the SSRF can be triggered by a crafted SAML authentication request sent by an attacker over the network. The CVSS score of 3.3 indicates moderate severity, and the EPSS score of <1% shows a low probability of exploitation. The issue is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited in the wild. Nonetheless, SSRF flaws are typically high‑risk due to the potential for unauthorized data exfiltration and lateral movement within internal networks.