miniOrange SAML SSO (com_miniorange_saml) 1.0.0 to 11.0.1 - Unauthenticated Authentication Bypass

miniOrange SAML SSO for Joomla versions 1.0.0 to 11.0.1 are affected by an unauthenticated authentication bypass, CVE-2026-77998, scored CVSS 4.0 10.0 (critical). UtilitiesSAML::validateSignature() performs a loose boolean check on the tri-state integer returned by PHP openssl_verify(), so the error return value of -1 is treated as truthy and therefore as a successful signature verification. An unauthenticated attacker can submit a crafted SAMLResponse holding an attacker-controlled NameID together with a deliberately malformed signature value that triggers an OpenSSL processing error, bypassing verification entirely and logging in as any existing user, administrators included. Fixed in 11.0.2, and in 6.4 for the ADFS and Google Apps editions. IMPORTANT version caveat: miniOrange ships several separately numbered editions of this extension, and Joomla sites commonly report two-segment versions such as 32.7, 42.5 or 44.0 which this range cannot order against 11.0.2. A site reporting a higher two-digit version is not necessarily patched. Confirm the edition and version with miniOrange before treating a site as safe, and where you cannot confirm it, disable or remove the extension rather than leaving an anonymous administrator login available.

Affected versions: ≥ 1.0.0 and < 11.0.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions

Our disclosure post

Two CVSS 10.0 Authentication Bypasses in miniOrange Extensions for Joomla

Two CVSS 10.0 unauthenticated bypasses in miniOrange Joomla extensions: CVE-2026-77995 in OAuth Client, fixed in 3.2.0, and CVE-2026-77998 in SAML SSO.

24 Aug 2026