miniOrange SAML SSO Extensions for Joomla: Security Vulnerability Fix (CVE-2026-77998)

1. Summary

• CVE ID = CVE-2026-77998

• Vulnerability Type = Improper Signature Verification, Authentication Bypass (CWE-639)

• Affected Products = 7 miniOrange SAML SSO/SP extensions for Joomla; see Fixed Versions below

2. Overview

A critical vulnerability was found across several miniOrange SAML SSO extensions for Joomla that could let an unauthenticated attacker log into any account on an affected site, including administrator accounts, by sending a specially crafted SAML response. Fixed versions are available for every affected product listed below, and sites running an older version should update immediately.

3. Technical Details

Root cause: The affected extensions validate SAML assertions using PHP's openssl_verify() function, which returns 1 for a valid signature, 0 for an invalid one, and -1 when OpenSSL itself hits a processing error. The verification code checked this return value with a loose truthy check instead of confirming it was exactly 1. Because -1 evaluates as true in PHP, a malformed signature that triggered an OpenSSL error was incorrectly accepted as valid.

Attack vector: An attacker with no valid credentials could send a crafted SAML response to the site's SAML endpoint, setting the NameID field to a target account (such as an administrator) and including a deliberately malformed signature designed to force this OpenSSL error. The flawed verification logic would then authenticate the attacker as that account. Exploitation requires no user interaction.

Impact: Exploiting this issue lets an unauthenticated attacker impersonate a targeted account on the site, including administrators, resulting in full site takeover.

Note: No verified proof-of-concept exploit code has been published for this issue.

4. Fixed Versions

5. Vulnerability Resolution

The signature verification logic was updated to require a strict match against 1. Both 0 (an invalid signature) and -1 (an OpenSSL processing error) are now treated as verification failures, so the login flow fails closed instead of defaulting to success. This change applies to all extensions listed above; a fixed version is available for each.

6. Remediation Steps

1. Identify which of the affected extensions listed above is installed on your site and check its current version.

2. Log in to the miniOrange portal using this link: https://portal.miniorange.com/ (with the same credentials used to procure the licence).

3. Navigate to the Downloads section from the left vertical menu bar.

4. Download the latest version of your extension.

5. Update to the fixed version.

6. After updating, confirm your extension is running the fixed version listed in the table above.