Arbitrary Account Takeover Vulnerability in Joomla Extension by miniOrange
CVE-2026-77995

10CRITICAL

Key Information:

Vendor: Miniorange.com
Status: Miniorange Oauth Client Extension For Joomla
Vendor: CVE Published:; 24 August 2026

🔔 Create Miniorange.com Vulnerability Alert

What is CVE-2026-77995?

The miniOrange OAuth Client for Joomla is susceptible to a significant security issue where an attacker can manipulate cookie values, facilitating unauthorized login to any account, including those with administrative privileges. This vulnerability poses a severe risk to user data integrity and site security.

Affected Version(s)

miniOrange OAuth Client extension for Joomla 1.0.0-3.1.9

References

https://www.miniorange.com/

product

CVSS V4

Score:

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 24, 2026
Vulnerability Reserved
Aug 21, 2026

Credit

Krzysztof Zając, CERT PL

CVE-2026-77995 Data

JSON