CVE-2026-77995: CWE-639: Authorization Bypass Through User-Controlled Key in miniorange.com miniOrange OAuth Client (free) extension for Joomla
Description
A critical authorization bypass vulnerability (CVE-2026-77995) exists in the miniOrange OAuth Client (free) extension for Joomla. Versions prior to 3.2.0 for miniOrange OAuth Client and prior to 1.2.2 for related OAuth Single Sign-On extensions are affected. The flaw allows an attacker to manipulate a cookie value to log in as arbitrary users, including administrators, leading to arbitrary account takeover.
CVSS v4.0
Score 10.0critical
Affected software
miniorange.com
miniOrange OAuth Client (free) extension for Joomla
miniorange.com
OAuth Single Sign-On – OIDC SSO | Login with Azure AD (free) extension for Joomla
miniorange.com
Login with Keycloak OAuth Single Sign-On (SSO) (free) extension for Joomla
miniorange.com
Single Sign-On for Educational Institutes (free) extension for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77995 is an authorization bypass vulnerability classified under CWE-639 affecting multiple miniOrange OAuth Single Sign-On extensions for Joomla. The vulnerability arises from improper validation of a user-controlled key (cookie value), which can be manipulated by an attacker to bypass authentication controls and gain unauthorized access to arbitrary accounts, including administrative accounts. This impacts miniOrange OAuth Client versions before 3.2.0 and OAuth Single Sign-On extensions before 1.2.2.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass authorization controls and log in as any user, including administrators. This results in complete account takeover, potentially leading to full system compromise depending on the privileges of the targeted account.
Mitigation Recommendations
No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected extensions and monitor for suspicious activity related to cookie manipulation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-21T19:23:55.924Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8c45b3acd9273b4994634f
Added to database: 08/24/2026, 13:22:59 UTC
Last enriched: 09/15/2026, 01:19:29 UTC
Last updated: 10/08/2026, 18:48:48 UTC
Views: 204
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.