Threat database

CVE-2026-107433 is a missing authorization vulnerability in the miniOrange WP OAuth Server plugin for WordPress. It affects versions from initial release up to 6.4.0. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to limited integrity and availability impacts. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity). No official patch or remediation information is provided in the available data.

CVE-2026-106610 is a critical vulnerability in the miniOrange OTP verification plugin that allows incorrect privilege assignment leading to privilege escalation. It affects versions from the initial release up to 5.5.7. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

A critical authorization bypass vulnerability (CVE-2026-77995) exists in the miniOrange OAuth Client (free) extension for Joomla. Versions prior to 3.2.0 for miniOrange OAuth Client and prior to 1.2.2 for related OAuth Single Sign-On extensions are affected. The flaw allows an attacker to manipulate a cookie value to log in as arbitrary users, including administrators, leading to arbitrary account takeover.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

CVE-2026-65520 is a critical unauthenticated SQL Injection vulnerability affecting miniOrange WP OAuth Server versions up to and including 6.2.0. This flaw allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently confirmed from the vendor. Users should monitor vendor advisories for updates and apply fixes once available.

Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.