CVE-2026-77998: Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mosamlvalidatesignature() function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wpsetauthcookie() being called for the targeted account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely by submitting a crafted SAMLResponse. The attacker needs to target an existing Joomla user account and can impersonate that user, including an administrator.
What does an attacker need to send to bypass authentication?
The crafted SAMLResponse must contain an attacker-controlled NameID for the account being targeted and a deliberately malformed signature that causes an OpenSSL processing error. The vulnerable signature-validation logic treats that error as a successful verification.
Which extension versions are affected?
Affected versions are miniOrange SAML SSO before 11.0.2, SAML SP Single Sign On – Login with ADFS before 6.4, and SAML SP Single Sign On – SAML SSO login with Google Apps before 6.4.