CVE-2026-77995
Received Received - Intake

Arbitrary Account Takeover in miniOrange OAuth Client Joomla Extension

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Joomla! Project

Description
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-77995
EUVD
EUVD-2026-64844

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniorange oauth_client to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows attackers to take over arbitrary accounts, including admin accounts, by manipulating a cookie value in the miniOrange OAuth Client plugin for Joomla. The flaw exists in versions before 3.2.0 and enables unauthorized login without needing credentials.

Impact Analysis

Attackers could gain full control of your Joomla site, steal sensitive data, modify content, or install malware. If you are an admin, your entire site and user accounts are at risk. The impact is severe due to the high CVSS score of 10.0.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage if exploited.

Mitigation Strategies

Update the miniOrange OAuth Client plugin to version 3.2.0 or higher to address the arbitrary account takeover vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77995. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart