CVE-2026-77998
Received Received - Intake

Unauthenticated Authentication Bypass in miniOrange SAML SSO Joomla Extension

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Joomla! Project

Description
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-77998
EUVD
EUVD-2026-65476

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
miniorange miniorange_saml_sso to 11.0.2 (exc)
miniorange miniorange_saml_sso to 6.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated authentication bypass in Joomla extensions from miniorange.com. It affects versions of miniOrange SAML SSO below 11.0.2, SAML SP Single Sign On – Login with ADFS below 6.4, and SAML SP Single Sign On – SAML SSO login with Google Apps below 6.4. The issue occurs due to a flawed signature verification process in the mo_saml_validate_signature() function, which incorrectly treats an error return value from PHP's openssl_verify() as a successful verification. This allows attackers to bypass authentication and log in as any Joomla user, including administrators, by submitting a crafted SAMLResponse with a malformed signature.

Detection Guidance

Check Joomla extensions for miniOrange SAML SSO versions below 11.0.2, SAML SP Single Sign On below 6.4, or Google Apps integration below 6.4. Look for unauthorized login attempts or SAMLResponse parameters with malformed signatures.

Impact Analysis

This vulnerability allows unauthenticated attackers to gain unauthorized access to Joomla websites using the affected extensions. Attackers can impersonate any user, including administrators, potentially taking full control of the website. This could lead to data theft, defacement, malware distribution, or further compromise of the server hosting the Joomla site.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive user data. GDPR requires protecting personal data, and a breach could lead to violations. HIPAA mandates strict access controls for protected health information; unauthorized access would constitute a breach. Organizations using these Joomla extensions may face regulatory fines, legal liabilities, and reputational damage.

Mitigation Strategies

Update affected miniOrange SAML extensions to patched versions immediately. Disable SAML authentication temporarily if updates are not available. Monitor logs for suspicious login attempts or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart