CVE-2026-77998: CWE-639: Authorization Bypass Through User-Controlled Key in miniorange.com SAML SSO Free for Joomla extension for Joomla

The vulnerability (CVE-2026-77998) affects miniOrange SAML SSO Free for Joomla extension versions 1.0.0 through 11.0.1. The root cause is that the mo_saml_validate_signature() function performs a loose boolean check on the tri-state integer returned by PHP's openssl_verify(). Specifically, an error return value of -1 is evaluated as truthy, leading to acceptance of invalid signatures. An attacker can exploit this by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature that triggers an OpenSSL processing error. This bypasses signature verification entirely, resulting in the attacker being authenticated as any existing Joomla user, including administrators, via the wp_set_auth_cookie() call.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain access as any Joomla user, including administrative accounts. This compromises the confidentiality, integrity, and availability of the affected Joomla site. The CVSS 4.0 base score is 10.0 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should consider disabling the affected extension or restricting access to SAML SSO functionality to trusted users only. Monitor vendor communications for updates and apply official fixes promptly once released.