CVE-2026-77995: miniOrange OAuth Client Auth Bypass Flaw

CVE-2026-77995 Overview

CVE-2026-77995 is an arbitrary account takeover vulnerability in the miniOrange OAuth Client extension for Joomla, affecting versions prior to 3.2.0. The flaw allows unauthenticated attackers to manipulate a cookie value to authenticate as any user account, including administrators. The weakness is categorized under CWE-639: Authorization Bypass Through User-Controlled Key. Successful exploitation grants full control over the affected Joomla site, including administrative privileges, content, and connected identity workflows.

Critical Impact
Attackers can log in as arbitrary users, including administrators, by manipulating a cookie value on any Joomla site running a vulnerable version of the miniOrange OAuth Client.

Affected Products

miniOrange OAuth Client for Joomla, versions prior to 3.2.0
Joomla sites integrating OAuth authentication through the miniOrange extension
Any downstream applications relying on this extension for identity federation

Discovery Timeline

2026-08-24 - CVE-2026-77995 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-77995

Vulnerability Analysis

The miniOrange OAuth Client extension authenticates users based on a value stored in a client-controlled cookie. The extension trusts this cookie as an authoritative user identifier without verifying its integrity against a server-side session or a cryptographically signed token. An attacker can set or modify the cookie to reference another account and be logged in as that user. Because Joomla administrators are addressable through the same authentication path, the flaw yields full administrative access. The vulnerability requires no privileges, no user interaction, and is exploitable remotely over the network.

Root Cause

The root cause is authorization bypass through a user-controlled key [CWE-639]. The extension uses a cookie value as a primary reference to the authenticated identity. It does not bind the identifier to a server-verified session or validate a signed OAuth assertion before establishing the login state.

Attack Vector

An unauthenticated attacker sends an HTTP request to the Joomla site with a crafted cookie referencing a target account identifier. The application processes the cookie, resolves it to the specified user, and issues an authenticated session. The attacker then operates as that user through the standard Joomla administrator interface.

No verified public exploit code is available at the time of writing. See the miniOrange vendor site for the current advisory and fixed release notes.

Root Cause References

Detection Methods for CVE-2026-77995

Indicators of Compromise

Unexpected administrator logins recorded in Joomla's user log or web server access logs from unfamiliar IP addresses.
Requests to miniOrange OAuth Client endpoints carrying unusual or manipulated cookie values tied to privileged accounts.
Creation of new administrator or Super User accounts, or privilege changes to existing accounts, shortly after suspicious OAuth-related requests.
Installation of new Joomla extensions, template edits, or PHP file changes following anomalous authentication events.

Detection Strategies

Compare authenticated session identifiers against server-side session state to flag sessions that were established without a corresponding legitimate OAuth callback.
Alert on any HTTP request to miniOrange OAuth Client URLs that supplies a cookie value referencing an administrator account.
Correlate authentication events with subsequent administrative actions such as user creation, extension installation, and file uploads.

Monitoring Recommendations

Ingest Joomla application logs and web server access logs into a centralized analytics platform to enable retrospective hunting against known miniOrange OAuth Client request patterns.
Monitor for privilege escalations and new Super User creations, and require out-of-band approval for these changes.
Track outbound connections from the Joomla host to unexpected destinations, which may indicate webshell activity following account takeover.

How to Mitigate CVE-2026-77995

Immediate Actions Required

Upgrade the miniOrange OAuth Client for Joomla to version 3.2.0 or later on every affected site.
Invalidate all existing sessions and force password resets for administrator and Super User accounts.
Audit the Joomla user table for unauthorized accounts, role changes, and recently modified credentials.
Review installed extensions, template files, and the images/ and tmp/ directories for unexpected PHP files or webshells.

Patch Information

The issue is resolved in miniOrange OAuth Client for Joomla version 3.2.0. Refer to the miniOrange vendor site for the current advisory, download links, and upgrade instructions.

Workarounds

Disable or uninstall the miniOrange OAuth Client extension until it can be upgraded to a fixed version.
Restrict access to the Joomla administrator path (/administrator) at the web server or WAF layer to trusted source IP ranges.
Add a WAF rule to block requests to miniOrange OAuth Client endpoints that carry unexpected or malformed authentication cookies.

bash

# Example: temporarily disable the extension via Joomla CLI
php cli/joomla.php extension:disable --name="miniOrange OAuth Client"

# Example: restrict administrator access at the web server (nginx)
location ^~ /administrator/ {
    allow 203.0.113.0/24;
    deny all;
}