CVE-2022-26493

HIGH 8.8CVE-2022-26493 · Published 03/06/2022 · updated 17/06/2026

In short

CVE-2022-26493 is a HIGH (CVSS 8.8) vulnerability affecting saml sp 2.0 single sign on (drupal).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 48.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
saml sp 2.0 single sign on drupal	`≥ 7.x, ≤ 7.x-2.57≥ 8.x, ≤ 8.x-2.24`	No fix yet

Description

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.

References

rafarmerjr1.github.io/2022/06/13/SAML-miniOrange.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free