CVE-2026-77998 Overview
CVE-2026-77998 is an unauthenticated authentication bypass affecting multiple miniOrange Single Sign-On (SSO) extensions for Joomla. The flaw resides in the mo_saml_validate_signature() function, which performs a loose boolean check on the return value of PHP's openssl_verify(). Because openssl_verify() can return -1 on error, a truthy evaluation treats verification failures as successful signature checks. Unauthenticated attackers can submit a crafted SAMLResponse with an attacker-controlled NameID and a malformed signature to log in as any Joomla user, including administrators. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key).
Critical Impact
Unauthenticated remote attackers can impersonate any Joomla account, including administrators, achieving full site takeover through a crafted SAML response.
Affected Products
- miniOrange SAML SSO for Joomla < 11.0.2
- SAML SP Single Sign On – Login with ADFS < 6.4
- SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4
Discovery Timeline
- 2026-08-25 - CVE-2026-77998 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77998
Vulnerability Analysis
The vulnerability is an authentication bypass in the SAML signature validation routine used by the affected miniOrange Joomla extensions. SAML Single Sign-On relies on cryptographic signatures on assertions to prove authenticity of the identity provider. When signature verification is broken, the entire trust model collapses, allowing an attacker to forge identities against the service provider.
An attacker only needs the SSO endpoint URL and knowledge of a target Joomla username or email. By posting a crafted SAMLResponse that triggers an OpenSSL processing error, the attacker bypasses signature verification and is authenticated as the account referenced in the NameID field.
Root Cause
The mo_saml_validate_signature() function evaluates the return value of PHP's openssl_verify() using a loose truthiness check rather than a strict comparison against 1. PHP's openssl_verify() is documented as returning 1 for a valid signature, 0 for an invalid signature, and -1 on an internal error. In PHP, -1 evaluates as truthy in a boolean context, so a signature that causes an OpenSSL processing error is incorrectly treated as valid.
Attack Vector
Exploitation is remote, unauthenticated, and requires no user interaction. The attacker sends an HTTP POST to the Joomla SAML Assertion Consumer Service (ACS) endpoint containing a SAMLResponse parameter. The payload sets the NameID element to the target account, such as an administrator username, and includes a deliberately malformed SignatureValue designed to force openssl_verify() to return -1. The vulnerable code path then proceeds to authenticate the session for the specified account.
No verified proof-of-concept exploit code has been published. Refer to the miniOrange advisory portal for vendor guidance.
Detection Methods for CVE-2026-77998
Indicators of Compromise
- Unexpected administrator logins in Joomla audit logs with no corresponding identity provider authentication event
- SAML SAMLResponse submissions containing malformed or truncated SignatureValue elements
- POST requests to the SAML ACS endpoint from IP addresses not associated with the configured identity provider
- New administrator sessions initiated shortly after anomalous SAML traffic
Detection Strategies
- Correlate Joomla authentication events with identity provider (IdP) logs to identify SAML logins the IdP never issued
- Inspect the affected miniOrange extension code paths for calls to openssl_verify() and confirm strict equality checks against 1
- Alert on repeated POSTs to the SAML ACS endpoint carrying malformed XML signatures or invalid base64 in SignatureValue
Monitoring Recommendations
- Enable verbose logging on the miniOrange SAML extension and forward events to a central SIEM
- Monitor Joomla #__users table for privilege changes and creation of new administrator accounts
- Track web server access logs for repeated requests to the SAML consumer endpoint from a single source
How to Mitigate CVE-2026-77998
Immediate Actions Required
- Upgrade miniOrange SAML SSO for Joomla to version 11.0.2 or later
- Upgrade SAML SP Single Sign On – Login with ADFS to version 6.4 or later
- Upgrade SAML SP Single Sign On – SAML SSO login with Google Apps to version 6.4 or later
- Rotate credentials and invalidate active sessions for all Joomla administrator and privileged accounts
- Review authentication logs since deployment of the affected extension for signs of prior exploitation
Patch Information
Vendor-fixed versions are miniOrange SAML SSO 11.0.2, SAML SP Single Sign On – Login with ADFS 6.4, and SAML SP Single Sign On – SAML SSO login with Google Apps 6.4. Consult the miniOrange website for release notes and upgrade instructions.
Workarounds
- Disable the affected miniOrange SAML extension until patched versions are installed
- Restrict access to the SAML ACS endpoint using a web application firewall rule that requires source IP addresses associated with the trusted identity provider
- Temporarily require multi-factor authentication for local Joomla administrator accounts as a compensating control
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
