CVE-2026-77995criticalCWE-639

CVE-2026-77995: falha crítica em miniorange.com Login with Keycloak OAuth…

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Login with Keycloak OAuth Single Sign-On extension for Joomla+ Monitorar miniOrange OAuth Client extension for Joomla

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.4%
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
miniorange.com · Login with Keycloak OAuth Single Sign-On (SSO) (free) extension for Joomlaminiorange.com · miniOrange OAuth Client (free) extension for Joomlaminiorange.com · OAuth Single Sign-On – OIDC SSO | Login with Azure AD (free) extension for Joomlaminiorange.com · Single Sign-On for Educational Institutes (free) extension for Joomla