Executive brief
Several miniOrange OAuth and Single Sign-On (SSO) extensions for Joomla contain a flaw that allows attackers to hijack user accounts, including administrator accounts, by manipulating cookie values. This could enable attackers to impersonate legitimate users, access sensitive data, modify website content, or perform administrative actions without authorization.
Technical details
The vulnerability exists in multiple miniOrange Joomla extensions (miniOrange OAuth Client, OAuth Single Sign-On – OIDC SSO, Login with Keycloak OAuth SSO, and Single Sign-On for Educational Institutes) where insufficient validation of cookie values allows authentication bypass. An attacker can manipulate session or authentication cookies to forge a login as any arbitrary user, including administrative accounts. The attack does not require special network privileges and can be performed by an unauthenticated attacker with ability to modify cookies on their client. Exploitation results in full account takeover with all associated privileges. Patches are available in miniOrange OAuth Client 3.2.0 and SSO extensions version 1.2.2 or later.
Affected products
- miniOrange miniOrange OAuth Client < 3.2.0
- miniOrange OAuth Single Sign-On – OIDC SSO < 1.2.2
- miniOrange Login with Keycloak OAuth Single Sign-On < 1.2.2
- miniOrange Single Sign-On for Educational Institutes < 1.2.2
Timeline
- 2026-08-24: disclosed