CVE-2026-5343: SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031

Synopsis

An authentication bypass in the Drupal SAML SSO - Service Provider module lets an unauthenticated attacker escalate privileges by exploiting improper handling of unusual SAML response conditions. The flaw is reachable over the network without any credentials or victim interaction, and successful exploitation yields full read and write access to the targeted Drupal site under another user's identity. A patched-image rebuild at version 3.1.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Drupal site's SAML endpoints over the network.

• AuthenticationNot required

  No credentials are needed; the bypass is exploitable by an unauthenticated attacker.

• Victim interactionNot required

  No user has to click a link or take any action for the attack to succeed.

• Attack complexityDetail

  AC:H indicates the exploit depends on specific SAML response conditions or timing that the attacker cannot fully control.

Blast Radius

• Authenticates to the Drupal site as another user, including potentially administrative accounts, bypassing SAML identity checks.
• Reads any content and user data accessible to the impersonated account, including private nodes and stored profile fields.
• Modifies site content, user records, and configuration to the extent permitted by the impersonated account's role.