CVE-2026-77995

Deferred Deferred - Pending Action

Arbitrary Account Takeover in miniOrange OAuth Client Joomla Extension

Publication date: 2026-08-24

Last updated on: 2026-09-08

Assigner: Joomla! Project

Description

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-09-08

Generated

2026-09-13

AI Q&A

2026-08-24

EPSS Evaluated

2026-09-12

NVD

CVE-2026-77995

EUVD

EUVD-2026-64844

Affected Vendors & Products

Vendor	Product	Version / Range
miniorange	oauth_client	to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability allows attackers to take over arbitrary accounts, including admin accounts, by manipulating a cookie value in the miniOrange OAuth Client plugin for Joomla. The flaw exists in versions before 3.2.0 and enables unauthorized login without needing credentials.

Detection Guidance

This vulnerability involves manipulation of a cookie value in the miniOrange OAuth Client extension for Joomla. To detect it, inspect HTTP requests and responses for suspicious cookie values in Joomla's admin interface or OAuth client settings. Check for unauthorized account logins or admin access patterns. No specific commands are provided in the context.

Impact Analysis

Attackers could gain full control of your Joomla site, steal sensitive data, modify content, or install malware. If you are an admin, your entire site and user accounts are at risk. The impact is severe due to the high CVSS score of 10.0.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage if exploited.

Mitigation Strategies

Update the miniOrange OAuth Client plugin to version 3.2.0 or higher to address the arbitrary account takeover vulnerability.

Hi! I’m here to help you understand CVE-2026-77995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70