There is a serious security issue with the Drupal integration in simplesamlphp about drupalauth HOT 2 CLOSED

I will review this and get this corrected on or after Dec 11th. Unfortunately 
that's the fasted I can get to this.

In terms of scope this vulnerability seems to be limited to installations that 
use the drupalauth:External authsource. Installations that use the 
drupalauth:UserPass do not appear to be affected.

Alan,

Thank you for identifying the issue and for submitting your patch. I have 
reviewed and tested your changes. Unfortunately, they do not work in all 
situations. So, I have incorporated the aspects that I could and resolved the 
cookie manipulation vector by including the uid along with the salt before 
generating the hash. This ensures that no one can manipulate the hash or the 
uid.

Unfortunately, this approach will require people to update both External.php 
and drupal4ssp.module.

I have uploaded a new release for download version 1.2.2.