← Back to the live CVE advisory feed

CVE-2026-77998: SAML SSO for Joomla extension for Joomla

Severity

10 (CRITICAL)

Vendor

JOOMLA

Affected versions

miniOrange SAML SSO prior to 11.0.2; SAML SP Login with ADFS prior to 6.4; SAML SP SSO login with Google Apps prior to 6

Fixed version

unknown

Patch status

Unknown

Published

2026-08-25T13:19:30.817

Modified

2026-08-25T15:16:44.920

Why it matters

This critical vulnerability allows unauthenticated attackers to bypass authentication in affected miniOrange SAML SSO for Joomla extensions. Attackers can log in as any existing Joomla user, including administrators, leading to complete system compromise and data breach. Prioritize internet-facing d

Recommended admin actions

• Identify and prioritize Joomla installations using miniOrange SAML SSO extensions.
• Upgrade miniOrange SAML SSO to version 11.0.2 or later.
• Upgrade SAML SP Single Sign On – Login with ADFS to version 6.4 or later.
• Upgrade SAML SP Single Sign On – SAML SSO login with Google Apps to version 6.4 or later.
• Review Joomla authentication logs for any unauthorized access or unusual activity.

Technical summary

Joomla Extension – miniorange.com – Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 – This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

View the official NVD record for CVE-2026-77998

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.