CVE-2026-77995: Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0
Published Aug 24, 2026
·Updated
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
Affected Software
1 affected component
miniOrange miniOrange OAuth Client<3.2.0
Event History
Aug 24, 2026
CVE Published
via MITRE·01:05 PM
Data Sourced
via MITRE·01:05 PM
DescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker be able to do to exploit this issue?
The issue is exploitable by manipulating a cookie value. No authentication or user interaction is required according to the supplied CVSS vector.
2
Which accounts are at risk if the extension is vulnerable?
An attacker can log in as arbitrary accounts, including administrator accounts. This can expose accounts with the highest privileges on the Joomla site.
3
Which versions require remediation?
miniOrange OAuth Client versions earlier than 3.2.0 are affected. Upgrade to version 3.2.0 or later.