External risk intelligence

Joomla SAML SSO Authentication Bypass via Signature Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-77998

The vulnerability affects SAML SSO authentication modules for web applications. These services are designed for user authentication and identity management, making them public-facing components that must be reachable to facilitate login processes for users, including those accessing the application over the internet.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical authentication bypass vulnerability in specific miniOrange SAML SSO extensions for Joomla. The flaw allows unauthenticated attackers to log in as any user, including administrators, by manipulating SAML responses. This bypasses standard security checks by exploiting how the system processes signature verification errors, potentially leading to unauthorized access and control of affected systems.

Attackers bypass login with fake SAML responses.
Unauthenticated admin access is possible.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending a specially crafted request to a vulnerable Joomla website. This request bypasses authentication, allowing an unauthenticated user to log in as any existing user, including administrators. The vulnerability lies in how the system verifies digital signatures for SAML authentication.

No authentication needed to begin.
Crafted SAML response triggers signature verification error.
Unauthenticated administrator access is possible.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could bypass authentication and log in as any existing user, including administrators, when the affected Joomla extensions are deployed. This is possible by submitting a specially crafted SAMLResponse that triggers an error in the signature verification process, effectively bypassing security checks.

User accounts and administrative access.
Malformed SAMLResponse bypasses verification.
Unauthorized account access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical unauthenticated authentication bypass in Joomla extensions allows attackers to log in as any user, including administrators, by exploiting a flaw in signature verification. The first step is to identify all instances of the affected miniorange.com SAML SSO extensions, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Assign platform or application owners.
Verify external exposure and reachability.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the miniOrange SAML SSO extension for Joomla?

These extensions enable Single Sign-On (SSO) for Joomla websites, allowing users to log in using credentials from external identity providers like Google or ADFS. They act as the bridge between the Joomla platform and these identity services to streamline the authentication process.

How does CVE-2026-77998 bypass authentication?

This vulnerability, classified as CWE-639, occurs because the software misinterprets a signature verification error as a success. When the system processes a crafted SAML response that forces an error, the code incorrectly treats the failure signal as valid, allowing the attacker to bypass authentication entirely.

Do I need a valid account to trigger this flaw?

No. The attack does not require pre-existing credentials or authentication. An attacker can submit a manipulated SAML response that contains a targeted username to gain access. Standard, error-free SAML traffic is not required to trigger the bug; the flaw specifically relies on forcing an internal processing error.

Why does Halo Surface Signal categorize this as external?

Because these SAML SSO modules must be reachable to facilitate logins for users—often over the internet—they are inherently public-facing. Halo Surface Signal identifies these components as highly likely to be accessible to outside traffic, increasing the relevance of this vulnerability for your environment.

How should I respond to this Joomla security issue?

Start by identifying all instances of the miniOrange SAML SSO extensions within your Joomla environment. Confirm which systems are externally reachable and prioritize them based on business criticality. Once identified, coordinate with the appropriate application owners to plan for updates to the latest secure versions.

References

www.miniorange.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.