Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Joomla

Description

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

miniorange.com miniOrange OAuth Client (free) extension for Joomla

Default version status: unaffected

  • 1.0.0-3.1.9affected

miniorange.com OAuth Single Sign-On – OIDC SSO | Login with Azure AD (free) extension for Joomla

Default version status: unaffected

  • 1.0.0-1.2.1affected

miniorange.com Login with Keycloak OAuth Single Sign-On (SSO) (free) extension for Joomla

Default version status: unaffected

  • 1.0.0-1.2.1affected

miniorange.com Single Sign-On for Educational Institutes (free) extension for Joomla

Default version status: unaffected

  • 1.0.0-1.2.1affected

References