EUVD-2026-65476
GHSA-mp5v-46h8-gw29
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, single-request bypass (AV:N/AC:L/PR:N/UI:N) yielding full administrator takeover, so C/I/A all High; scope Unchanged as compromise stays within the Joomla application.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On - Login with ADFS < 6.4, SAML SP Single Sign On - SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error - bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Articles & Coverage 2
AnalysisAI
Unauthenticated authentication bypass in miniOrange's SAML Single Sign-On extensions for Joomla (SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, and SAML SSO login with Google Apps < 6.4) lets remote attackers log in as any Joomla account, including administrators. The mo_saml_validate_signature() function treats OpenSSL's -1 error return as a successful signature verification, so a crafted SAMLResponse with an attacker-chosen NameID and a deliberately malformed signature bypasses validation entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Joomla site have one of the vulnerable miniOrange SAML SSO extensions installed and enabled as a Service Provider with an exposed Assertion Consumer Service endpoint - this is the extension's normal operating mode, so no non-default configuration is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than a high-CVSS-but-low-risk artifact: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact) aligns exactly with the description of a remote, unauthenticated, single-request bypass that grants administrator access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a SAMLResponse asserting NameID 'admin' (or any target Joomla account) and attaches a deliberately malformed signature value that causes openssl_verify() to return -1 rather than 0. They POST it directly to the extension's ACS endpoint over the network without any credentials; the loose check accepts the error as valid, an auth cookie is set for the targeted account, and the attacker gains administrator access. … |
| Remediation | Upgrade to fixed releases: SAML SSO for Joomla 11.0.2 or later, and both SAML SP Login with ADFS and SAML SSO login with Google Apps 6.4 or later, as implied by the affected-version ranges (verify exact patched builds with the vendor at https://www.miniorange.com/ since no dedicated advisory URL was supplied). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct comprehensive inventory of all Joomla installations running miniOrange SAML SSO (versions SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, SAML SSO login with Google Apps < 6.4) and document affected systems by version and business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today