Authentication Bypass Vulnerability in miniOrange SAML SSO by miniOrange
CVE-2026-77998

10CRITICAL

Key Information:

Vendor

Miniorange.com

Status
Saml Sso For Joomla Extension For Joomla
Saml Sp Single Sign On – Login With Adfs Extension For Joomla
Saml Sso Login With Google Apps Extension For Joomla
Vendor
CVE Published:
25 August 2026

What is CVE-2026-77998?

The miniOrange SAML SSO plugin contains a vulnerability that allows unauthorized users to bypass authentication. This is facilitated by the mo_saml_validate_signature() function, which improperly assesses a specific return value from PHP's openssl_verify() function. As a result, an attacker can manipulate the SAMLResponse parameter, submitting a crafted request that leads to unintended access to Joomla user accounts, including those of administrators. This flaw underscores the importance of robust validation mechanisms in authentication processes to mitigate the risk of unauthorized access.

Affected Version(s)

SAML SP Single Sign On – Login with ADFS extension for Joomla 1.0.0-6.3.0

SAML SSO for Joomla extension for Joomla 1.0.0-11.0.1

SAML SSO login with Google Apps extension for Joomla 1.0.0-6.3.0

References

https://www.miniorange.com/
product

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S. (m3ez)
Phil Taylor, mysites.guru
.