EUVD-2026-64844
GHSA-9v52-pgw4-78ww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Joomla site with OAuth Client enabled
-
DeliveryCraft or edit identity cookie value
-
ExploitSet cookie to admin account identifier
-
ExecutionSubmit request, extension trusts cookie
-
PersistAuthenticated session as administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The target Joomla site must have the miniOrange OAuth Client extension installed, published, and reachable over the network on a version below 3.2.0. Exploitation requires only manipulating the extension's identity/session cookie value to point at a chosen account (per CVSS PR:N/UI:N this needs no authentication and no user interaction). Limiting factors: the OAuth Client plugin must actually be enabled (sites that installed but disabled it are not exploitable through this path), and an affected extension version must be present; there is no platform-specific or complex configuration prerequisite beyond the plugin being active. |
| Impact | All available signals point to genuine high priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact) scores 10.0: network-reachable, low complexity, no privileges, no user interaction, full compromise. The impact is complete site takeover via admin impersonation, and the described technique (edit one cookie) is trivially automatable. Mitigating context: this is a specific Joomla SSO plugin rather than ubiquitous software, so the addressable population is bounded. No EPSS score, KEV listing, or POC was provided; absence of KEV means there is no confirmed active exploitation, and the low deployment footprint suggests any future exploitation would be opportunistic against exposed Joomla sites running this extension rather than internet-wide. The CVSS vector and description are consistent (both imply remote, unauthenticated account takeover), so there is no conflicting-signal concern here. |
| Exploit ScenarioDerived | An attacker browses to a Joomla site that uses the miniOrange OAuth Client, intercepts or crafts the relevant session cookie, and sets its value to reference a super-administrator account. On the next request the extension treats the attacker as that admin, granting full control of the site with no credentials or user interaction. No public POC was provided, but the described one-cookie manipulation makes reliable exploitation straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.
RemediationAI
Upgrade the miniOrange OAuth Client extension for Joomla to version 3.2.0 or later, the first release outside the affected range (Vendor-released patch: 3.2.0, inferred from the '< 3.2.0' affected-version boundary; confirm the exact fixed build with the vendor). Until patched, reduce exposure by unpublishing or disabling the OAuth Client plugin so the cookie-based login path cannot be triggered, or place the Joomla administrator area and login endpoints behind IP allowlisting or a WAF rule that blocks tampering with the extension's session/identity cookie; note that disabling the plugin breaks SSO login and forces users onto local Joomla credentials. Also rotate administrator credentials and invalidate existing sessions after patching, since silent account takeover may have left no obvious trace. Consult the vendor at https://www.miniorange.com/ for the official advisory and confirmed fixed version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the miniOrange OAuth Client extension for Joomla (CPE cpe:2.3:a:miniorange.com:miniorange_oauth_client_extension_for_joomla), a Single Sign-On plugin that lets a Joomla site delegate login to external OAuth/OIDC identity providers. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the extension uses a cookie value the client can modify to determine which account the request is authenticated as, rather than binding the session to a server-side, integrity-protected token. Because the OAuth callback/session-establishment logic keys off attacker-supplied data, changing the cookie to reference another user's identifier (or an admin account) causes the extension to log the attacker in as that account.
Know when Miniorange Oauth Client Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Cookie manipulation is remote, low-complexity, needs no privileges or interaction, and yields full admin account takeover, so C/I/A are High; scope kept Unchanged as compromise stays within the Joomla application.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
Executive ViewAI
The miniOrange OAuth Client extension for Joomla (versions prior to 3.2.0) contains a critical authentication bypass enabling unauthenticated remote attackers to assume any user account, including administrator privileges, by manipulating a single cookie value. Organizations using this extension face immediate risk of unauthorized administrative access and complete system compromise. No public exploit has been identified at time of analysis, but the trivial network-based attack vector and CVSS 10.0 rating represent an urgent remediation priority.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the extension if non-essential to business operations; (2) Implement IP allowlisting for administrative and OAuth endpoints; (3) Enforce strict session cookie settings (HttpOnly, Secure, SameSite=Strict); (4) Deploy real-time alerting for abnormal authentication and privilege escalation attempts; (5) Apply WAF rules to detect and block malformed or suspicious cookie values; (6) Conduct immediate forensic audit of all administrative accounts for unauthorized access, credential creation, or privilege changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB