Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77998— Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4

Quick assessment

Affected
miniorange.com SAML SSO Free for Joomla extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述翻译如下： Joomla 扩展 – miniorange.com – 在 miniOrange SAML SSO < 11.0.2、SAML SP 单点登录 – 使用 ADFS 登录 < 6.4、SAML SP 单点登录 – 使用 Google Apps 的 SAML SSO 登录 < 6.4 版本中存在未认证的认证绕过漏洞，该漏洞位于 SAMLResponse 参数中。 此漏洞的原因是 函数对 PHP 的 函数返回的原始三态整数执行了宽松的布尔检查，导致错误返回值 -1 被评估为真值（truthy），从而

CVSS 10.0 · Critical EPSS 0.34% · P27
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77998

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
miniorange.com SAML SSO Free for Joomla extension for Joomla 1.0.0-11.0.1 -
miniorange.com SAML SSO Basic for Joomla extension for Joomla 1.0.0-13.1.0 -
miniorange.com SAML SSO Standard for Joomla extension for Joomla 1.0.0-24.1.0 -
miniorange.com SAML SSO Premium for Joomla extension for Joomla 1.0.0-34.1.0 -
miniorange.com SAML SSO Enterprise for Joomla extension for Joomla 1.0.0-44.1.0 -
miniorange.com SAML SP Single Sign On – Login with ADFS extension for Joomla 1.0.0-6.3.0 -
miniorange.com SAML SSO login with Google Apps extension for Joomla 1.0.0-6.3.0 -
miniorange.com OAuth Single Sign-On – OIDC SSO | Login with Azure AD 1.0.0-1.2.1 -
miniorange.com Login with Keycloak OAuth Single Sign-On (SSO) 1.0.0-1.2.1 -
miniorange.com Single Sign-On for Educational Institutes - version 1.0.0-1.2.1 -

II. Public POCs for CVE-2026-77998

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77998

请登录查看更多情报信息。

Vendor Pages for CVE-2026-77998 (1)

IV. Related Vulnerabilities

Same vendor: miniorange.com
Same weakness: CWE-639

V. Comments for CVE-2026-77998

No comments yet

Leave a comment