SAML SSO - Service Provider 7.x-2.x, xxxx-xx-xx (development version)
-----------------------

SAML SSO - Service Provider 7.x-2.75, 2026-09-23
-----------------------
- Fix the cross-site scripting sanitization function.
- Security: Addresses an access bypass that allowed blocked user accounts to obtain an authenticated session through the SAML assertion consumer.
- Security: Addresses a site wide weakening of SecKit's cross site request forgery origin protection caused by adding entries to SecKit's origin whitelist on every request.
- Security: Addresses disclosure of Service Provider private keys shipped in the module resources directory and downloadable by anonymous users.
- Security: Addresses server side request forgery and local file disclosure through the identity provider metadata URL.
- Security: Addresses SAML response replay and acceptance of assertions outside their validity window.
- Security: Addresses information disclosure of the stored cleartext miniOrange account password left in the variables table by earlier releases.
- Security: Addresses embedded miniOrange API credentials shipped in the module source and used as a shared default identity to sign outbound requests.
- Security: Addresses improper certificate validation when fetching Identity Provider metadata over HTTPS.
- Security: Addresses stored cross site scripting in administration page output and in the anonymously reachable SAML metadata document.
- Security: Addresses an authentication bypass in the SAML assertion consumer where a response could select a non RSA signature algorithm and cause the identity provider public certificate to be used as a shared secret.
- Security: Addresses weak cryptographic practices in the validation of SAML signatures.
- Security: Addresses an open redirect through the unvalidated SAML RelayState that is used as the post login redirect target and was seeded from the HTTP referer header.
- Security: Addresses an access bypass that let an unauthenticated attacker replace the module's SAML signing trust anchor with a certificate of their choosing.

SAML SSO - Service Provider 7.x-2.74, 2026-04-01
-----------------------
- Prevent potential cross-site scripting.

SAML SSO - Service Provider 7.x-2.73, 2026-02-25
-----------------------
- Prevent potential cross-site scripting.
