CVE-2026-77995: Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2
Published Aug 24, 2026
·Updated
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
Affected Software
4 affected components
miniOrange miniOrange OAuth Client<3.2.0
miniOrange OAuth Single Sign-On – OIDC SSO<1.2.2
miniOrange Login with Keycloak OAuth Single Sign-On (SSO)<1.2.2
miniOrange Single Sign-On for Educational Institutes<1.2.2
Event History
Aug 24, 2026
CVE Published
via MITRE·01:05 PM
Data Sourced
via MITRE·01:05 PM
DescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker be able to do to exploit this issue?
The issue is exploitable by manipulating a cookie value. No authentication or user interaction is required according to the supplied CVSS vector.
2
Which accounts are at risk if the extension is vulnerable?
An attacker can log in as arbitrary accounts, including administrator accounts. This can expose accounts with the highest privileges on the Joomla site.
3
Which versions require remediation?
miniOrange OAuth Client versions earlier than 3.2.0 are affected. Upgrade to version 3.2.0 or later.