Saml Single Sign On Sso Login
Monthly
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.4) lets unauthenticated attackers log in as any user, including administrators. The flaw stems from mo_saml_validate_signature() applying a loose boolean check to the tri-state integer returned by PHP's openssl_verify(), so the error value -1 is treated as truthy and accepted as a valid signature. Reported by Wordfence with a CVSS of 9.8; no public exploit has been identified at time of analysis, though the root cause and vulnerable code lines are publicly documented in the plugin source.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.