miniOrange SAML SSO CVE-2026-77998

Exploitation requires that the target Joomla site have one of the vulnerable miniOrange SAML SSO extensions installed and enabled as a Service Provider with an exposed Assertion Consumer Service endpoint - this is the extension's normal operating mode, so no non-default configuration is needed. The attacker must know or guess a valid Joomla username/NameID for the account to impersonate (administrator usernames are often predictable). Limiting factors: the vulnerable SSO extension must actually be active (a Joomla site without these extensions is unaffected), and the ACS endpoint must be reachable by the attacker. No authentication (PR:N), no user interaction (UI:N), and no special client platform are required.

This is a genuine top-priority issue rather than a high-CVSS-but-low-risk artifact: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact) aligns exactly with the description of a remote, unauthenticated, single-request bypass that grants administrator access. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation-probability and automatability signals are unavailable and cannot corroborate or contradict the severity - but the low technical bar and full-admin outcome mean any exposed, vulnerable instance should be treated as urgent even for a mid-sized operator with a small IT team. The main uncertainty is deployment exposure, not exploitability: the bug is deterministic and requires no special access, so absence of a published POC should not be read as low real-world risk.

An attacker crafts a SAMLResponse asserting NameID 'admin' (or any target Joomla account) and attaches a deliberately malformed signature value that causes openssl_verify() to return -1 rather than 0. They POST it directly to the extension's ACS endpoint over the network without any credentials; the loose check accepts the error as valid, an auth cookie is set for the targeted account, and the attacker gains administrator access. No public POC has been identified, but the single-request, no-authentication nature makes weaponization straightforward.