Junglewise Threat Intelligence

CVE-2026-15013: miniOrange SAML Single Sign On authentication bypass via algorithm confusion

CVE-2026-15013 · Severity: critical · CVSS 9.8 · Published 2026-07-16

Technologies: miniOrange (cyberlord92) SAML Single Sign On – SSO Login. Vendors: miniOrange.

Executive brief

The SAML Single Sign On plugin for WordPress, which allows users to log into websites using external identity providers, contains a critical security flaw. This vulnerability allows an attacker to bypass the login process and gain full administrative access to the website without needing a password. This could lead to a complete site takeover, theft of sensitive user data, and disruption of business operations.

Technical details

The vulnerability is an authentication bypass via SAML Signature Algorithm Confusion in the `Mo_SAML_Utilities::mo_saml_cast_key()` function. The plugin incorrectly trusts the `SignatureMethod` Algorithm attribute provided in the attacker-controlled `SAMLResponse` instead of using a locally configured, trusted algorithm. This allows an attacker to force the plugin to treat the Identity Provider's (IdP) RSA public key as an HMAC-SHA1 shared secret. By signing a forged SAML assertion with this public key using HMAC, an attacker can bypass signature verification and gain full administrative access to the WordPress site. The issue affects all versions up to and including 5.4.3.

Affected products

  • miniOrange (cyberlord92) SAML Single Sign On – SSO Login Up to and including 5.4.3

Timeline

  • 2026-07-16: disclosed
  • 2026-07-16: advisory

References

Related threats