CVE-2026-77998Patch

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.miniorange.com/

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-08-27); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-27	2	Disclosure1Patch1
2026-08-31	1	Patch1

Full discourse3 posts

CCB Alert@CCBalert46d
Patch
Warning: Critical Authentication Bypass in #Joomla miniOrange #SAML SSO. #CVE-2026-77998 CVSS: 10.0. Unauthenticated attackers can log in as any existing user including administrators leading to #AccountTakeover! Update to 11.0.2 or 6.4. #Patch #Patch #Patch
Post summary
The post alerts users to a critical authentication bypass in Joomla miniOrange SAML SSO, highlighting the CVSS score and providing patch versions to mitigate the vulnerability.
01000304
7.2K followersView on X
SecAlerts@SecAlertsCo42d
Patch
🔓 miniOrange SAML SSO for Joomla has a CVSS 10 auth bypass — no credentials needed. CVE-2026-77998 lets attackers manipulate the SAMLResponse parameter to bypass login entirely. Patch to 11.0.2+ now. #cybersecurity #ciso #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-77998?utm_campaign=x https://t.co/nBjxRrdaJb
Post summary
The tweet highlights a severe (CVSS 10) authentication bypass flaw in miniOrange SAML SSO for Joomla (CVE‑2026‑77998) and informs that a patch is available in version 11.0.2+.
0000097
885 followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs46d
Disclosure
CVE-2026-77998 miniOrange SAML SSO for Joomla SAML assertion forgery could let unauthenticated attackers log in as any user, including administrators, in affected Joomla SSO deployments Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-08-25/TIER_2_CVE-2026-77998.md #IdentitySecurity #VulnerabilityManagement
Post summary
The text discloses a SAML assertion forgery vulnerability (CVE‑2026‑77998) in miniOrange SAML SSO for Joomla that lets unauthenticated attackers log in as any user, including administrators; no exploit code, patch, or active exploitation is mentioned.
0000054
59 followersView on X

Explore more

Back to dashboard