CVE-2026-77995 is an authorization bypass vulnerability (CWE-639) in the miniOrange OAuth Client extension for Joomla. Versions from 1.0.0 up to and including 3.1.9 are affected. The vulnerability arises from improper validation of a user-controlled key in a cookie, which can be manipulated by an attacker to bypass authentication controls and gain unauthorized access to arbitrary accounts, including admin accounts. The CVSS 4.0 base score is 10.0, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to take over any user account, including administrative accounts, leading to full system compromise. This can result in unauthorized access to sensitive data, modification or deletion of content, and potential complete control over the affected Joomla site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the miniOrange OAuth Client extension or restricting its usage to trusted environments. Monitor for vendor updates and apply patches promptly once available.