Affected versions: ≥ 1.0.0 and < 1.2.2
Full advisory: our disclosure post
CVE-2026-77995CriticalCVSS 10.0CVE published 24 August 2026Added to mySites.guru 24 August 2026
miniOrange Login with Azure AD / OAuth OIDC SSO (com_miniorange_oauth) free edition 1.0.0 to 1.2.1 - Unauthenticated Account Takeover (CVSS 10.0)
miniOrange OAuth Single Sign-On - OIDC SSO (shipped as Login with Azure AD) versions 1.0.0 to 1.2.1 are affected by the unauthenticated account takeover published as CVE-2026-77995, CVSS 4.0 10.0 Critical. Manipulating a cookie value lets an attacker with no login authenticate as an arbitrary account, Super Users included. This edition ships under the same com_miniorange_oauth element as the OAuth Client but on its own 1.x numbering, so it is matched on the display name; miniOrange confirmed in writing on 26 August 2026 that it is fixed in 1.2.2 (the OAuth Client itself is fixed in 3.2.0 and has its own rule). Update to 1.2.3 or later, which also fixes the separate CVE-2026-78074 extension uninstall flaw. If you cannot update immediately, disable the extension.
Is my site affected?
CVE-2026-77995 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| miniOrange OAuth Client | from 1.0.0 up to but not including 1.2.2 | 1.2.2 | Update miniOrange OAuth Client to 1.2.2 or later. |
| miniOrange OAuth Client | from 1.0.0 up to and including 3.1.9 | after 3.1.9 | Update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 3.1.9, so any later release is outside it. |
How CVE-2026-77995 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
10.0 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:H Confidentiality
- High. Data on other systems can be read
- SI:H Integrity
- High. Other systems can be altered
- SA:H Availability
- High. Other systems can be taken down
Timeline
- 24 August 2026CVE-2026-77995 record published by its CNA
- 24 August 2026mySites.guru check added for miniOrange OAuth Client (from 1.0.0 up to but not including 1.2.2)
- 24 August 2026mySites.guru check added for miniOrange OAuth Client (from 1.0.0 up to and including 3.1.9)
- 24 August 2026We published: Three CVEs in miniOrange Extensions for Joomla, All Now Fixed
Rule details
miniOrange OAuth Client - miniOrange OAuth Client (com_miniorange_oauth) 1.0.0 to 3.1.9 - Unauthenticated Account Takeover (CVSS 10.0)
miniOrange OAuth Client versions 1.0.0 to 3.1.9 are affected by an unauthenticated account takeover, CVE-2026-77995, scored CVSS 4.0 10.0 (critical). Manipulation of a cookie value allows an attacker with no login to authenticate as an arbitrary account, Super Users included. Update the miniOrange OAuth Client to 3.2.0 or later. IMPORTANT edition caveat: miniOrange ships several separately numbered OIDC editions under this same com_miniorange_oauth element, including Login with Azure AD, Login with Keycloak OAuth Single Sign-On and Single Sign-On for Educational Institutes. miniOrange confirmed in writing on 26 August 2026 that those three are fixed in 1.2.2, not 3.2.0, and that all of the fixed versions they gave apply to the free editions only. Check the display name of the installed extension before acting on a version number, and if the site reports a two-segment version such as 32.0.1 or 34.0.0 it is a paid edition. miniOrange stated in writing on 4 September 2026 that CVE-2026-77995 was associated only with the free OAuth Client and that their investigation found the flaw in no version of the paid OAuth editions, which is why no paid security build was ever released. This rule's ceiling of 3.1.9 therefore excludes every paid build on purpose, and no paid install has ever been flagged by it. Note that this rests on the vendor's assessment: the CVE record still names a single product with no edition qualifier, and the same vendor scoped the SAML record to the free line before it had to be widened to name all four paid editions.
Affected versions: ≥ 1.0.0 and ≤ 3.1.9
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in miniOrange OAuth Client
Updating for CVE-2026-77995 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
miniOrange OAuth Client
- CVE-2026-78074 High, from 1.0.0 up to and including 3.2.0
References
- CVE-2026-77995 on cve.org (the official CVE record)
- CVE-2026-77995 in the NIST National Vulnerability Database
- Three CVEs in miniOrange Extensions for Joomla, All Now Fixed
CVE-2026-77995 questions
Which versions are affected by CVE-2026-77995?
CVE-2026-77995 is covered by 2 rules: miniOrange OAuth Client from 1.0.0 up to but not including 1.2.2; miniOrange OAuth Client from 1.0.0 up to and including 3.1.9.
How do I fix CVE-2026-77995?
It depends on the extension and release line your site runs. For miniOrange OAuth Client from 1.0.0 up to but not including 1.2.2: update miniOrange OAuth Client to 1.2.2 or later. For miniOrange OAuth Client from 1.0.0 up to and including 3.1.9: update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 3.1.9, so any later release is outside it.
How severe is CVE-2026-77995?
Joomla CNA scores it 10.0 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 15 November 2026.