# miniOrange vulnerabilities Source: https://junglewise.ai/threats/vendors/miniorange Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/miniorange.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 47 vulnerabilities in miniOrange: 2 in the last 7 days and 33 in the last 90 days, 14 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123696, was published on 11 November 2026. 15 vulnerabilities in the last four weeks, up 88% on the four before (8). 1 critical against 5. 6 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 16 - Last 90 days: 33 - All time: 47 (14 critical, 0 exploited in the wild) ## About miniOrange miniOrange is a provider of identity and access management solutions, including single sign-on and multi-factor authentication. ## Latest miniOrange vulnerabilities - [CVE-2026-123696: Security For WooCommerce missing authorization in 2FA reset](https://junglewise.ai/threats/cve-2026-123696-the-security-for-woocommerce-wordpress-plugin-through-1-0-16) (info, published 11 Nov 2026) - [CVE-2026-120844: miniOrange OAuth Single Sign On privilege escalation](https://junglewise.ai/threats/cve-2026-120844-incorrect-privilege-assignment-vulnerability-in-miniorange-oauth) (critical, CVSS 9.8, published 6 Nov 2026) - [CVE-2026-62126: miniOrange SAML SP Single Sign On resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-62126-allocation-of-resources-without-limits-or-throttling) (high, CVSS 7.5, published 4 Nov 2026) - [CVE-2026-107268: Drupal miniorange_2fa API key disclosure in headless endpoint](https://junglewise.ai/threats/cve-2026-107268-drupal-contrib-2026-207-this-module-enables-you-to-add-an-extra) (info, published 30 Oct 2026) - [CVE-2026-54852: miniOrange Page Restriction broken access control](https://junglewise.ai/threats/cve-2026-54852-missing-authorization-vulnerability-in-miniorange-page) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-114696: miniOrange Page Restriction broken access control](https://junglewise.ai/threats/cve-2026-114696-missing-authorization-vulnerability-in-miniorange-page) (medium, CVSS 5.3, published 22 Oct 2026) - [CVE-2026-87953: miniorange_saml SAML Service Provider URL validation bypass](https://junglewise.ai/threats/cve-2026-87953-drupal-contrib-2026-151-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87951: Drupal SAML SSO Service Provider information disclosure in configuration storage](https://junglewise.ai/threats/cve-2026-87951-drupal-contrib-2026-149-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87950: miniOrange SAML Service Provider embedded credentials information disclosure](https://junglewise.ai/threats/cve-2026-87950-drupal-contrib-2026-148-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87949: SAML SSO Service Provider cross-site scripting in SAML assertion display](https://junglewise.ai/threats/cve-2026-87949-drupal-contrib-2026-147-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87948: Drupal SAML SSO Service Provider cross-site scripting in HTML output](https://junglewise.ai/threats/cve-2026-87948-drupal-contrib-2026-146-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87947: Drupal miniorange_saml signature algorithm verification bypass](https://junglewise.ai/threats/cve-2026-87947-drupal-contrib-2026-145-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87946: Drupal SAML SSO Service Provider weak cryptographic practices](https://junglewise.ai/threats/cve-2026-87946-drupal-contrib-2026-144-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-87945: Drupal miniorange_saml open redirect in URL validation](https://junglewise.ai/threats/cve-2026-87945-drupal-contrib-2026-143-this-module-allows-you-to-configure-your) (info, published 22 Oct 2026) - [CVE-2026-111949: miniOrange 2FA authentication bypass via passkey rebinding](https://junglewise.ai/threats/cve-2026-111949-the-miniorange-2fa-wordpress-plugin-before-6-3-1-does-not) (info, published 21 Oct 2026) - [CVE-2026-103895: miniOrange OTP Login authentication bypass via Delay OTP](https://junglewise.ai/threats/cve-2026-103895-the-miniorange-otp-login-verification-and-sms-notifications) (high, CVSS 8.1, published 16 Oct 2026) - [CVE-2026-106610: miniOrange OTP Verification privilege escalation](https://junglewise.ai/threats/cve-2026-106610-incorrect-privilege-assignment-vulnerability-in-miniorange) (critical, CVSS 9.8, published 10 Oct 2026) - [CVE-2026-97274: miniOrange OAuth Single Sign On SSO authentication bypass](https://junglewise.ai/threats/cve-2026-97274-unauthenticated-bypass-vulnerability-in-oauth-single-sign-on-sso) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-97267: WordPress Prevent files / folders access plugin broken access control](https://junglewise.ai/threats/cve-2026-97267-subscriber-broken-access-control-in-prevent-files-folders-access) (medium, CVSS 4.3, published 30 Sep 2026) - [CVE-2026-85984: miniOrange OTP Login Verification and SMS Notifications authentication bypass](https://junglewise.ai/threats/cve-2026-85984-the-miniorange-otp-login-verification-and-sms-notifications) (critical, CVSS 9.8, published 26 Sep 2026) - [CVE-2026-82843: WP OAuth Server OpenID Connect identity assertion binding bypass](https://junglewise.ai/threats/cve-2026-82843-the-wp-oauth-server-login-with-wordpress-wordpress-plugin-before) (critical, CVSS 9, published 23 Sep 2026) - [CVE-2026-82842: miniorange SAML Single Sign On privilege escalation via account matching](https://junglewise.ai/threats/cve-2026-82842-the-saml-single-sign-on-wordpress-plugin-before-6-0-0-does-not) (high, CVSS 8.1, published 20 Sep 2026) - [CVE-2026-62108: Headless Single Sign On broken authentication bypass](https://junglewise.ai/threats/cve-2026-62108-headless-single-sign-on-broken-authentication-bypass) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2026-89027: miniOrange JWT Authentication for WP REST APIs authentication method downgrade](https://junglewise.ai/threats/cve-2026-89027-miniorange-jwt-authentication-for-wp-rest-apis-authentication) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-77771: miniOrange 2FA 2FA bypass via unscoped attempt limit](https://junglewise.ai/threats/cve-2026-77771-miniorange-2fa-2fa-bypass-via-unscoped-attempt-limit) (high, CVSS 7.5, published 10 Sep 2026) ## Most severe miniOrange vulnerabilities - [CVE-2026-77770: miniOrange 2FA missing authorization in option deletion](https://junglewise.ai/threats/cve-2026-77770-miniorange-2fa-missing-authorization-in-option-deletion) (critical, CVSS 10, published 10 Sep 2026) - [CVE-2026-62108: Headless Single Sign On broken authentication bypass](https://junglewise.ai/threats/cve-2026-62108-headless-single-sign-on-broken-authentication-bypass) (critical, CVSS 9.8, published 17 Sep 2026) - [CVE-2026-106610: miniOrange OTP Verification privilege escalation](https://junglewise.ai/threats/cve-2026-106610-incorrect-privilege-assignment-vulnerability-in-miniorange) (critical, CVSS 9.8, published 10 Oct 2026) - [CVE-2026-120844: miniOrange OAuth Single Sign On privilege escalation](https://junglewise.ai/threats/cve-2026-120844-incorrect-privilege-assignment-vulnerability-in-miniorange-oauth) (critical, CVSS 9.8, published 6 Nov 2026) - [CVE-2026-97274: miniOrange OAuth Single Sign On SSO authentication bypass](https://junglewise.ai/threats/cve-2026-97274-unauthenticated-bypass-vulnerability-in-oauth-single-sign-on-sso) (critical, CVSS 9.8, published 30 Sep 2026) - [CVE-2026-85984: miniOrange OTP Login Verification and SMS Notifications authentication bypass](https://junglewise.ai/threats/cve-2026-85984-the-miniorange-otp-login-verification-and-sms-notifications) (critical, CVSS 9.8, published 26 Sep 2026) - [CVE-2026-15981: miniOrange SAML Single Sign On authentication bypass in SSO Login plugin](https://junglewise.ai/threats/cve-2026-15981-miniorange-saml-single-sign-on-authentication-bypass-in-sso-login) (critical, CVSS 9.8, published 23 Jul 2026) - [CVE-2026-15013: miniOrange SAML Single Sign On authentication bypass via algorithm confusion](https://junglewise.ai/threats/cve-2026-15013-miniorange-saml-single-sign-on-authentication-bypass-via) (critical, CVSS 9.8, published 16 Jul 2026) - [CVE-2026-57807: miniOrange OAuth Single Sign On authentication bypass in OAuth Client](https://junglewise.ai/threats/cve-2026-57807-miniorange-oauth-single-sign-on-authentication-bypass-in-oauth) (critical, CVSS 9.8, published 10 Jul 2026) - [CVE-2026-12761: miniOrange Social Login and Register authentication bypass in Profile Completion flow](https://junglewise.ai/threats/cve-2026-12761-miniorange-social-login-and-register-authentication-bypass-in) (critical, CVSS 9.8, published 10 Jul 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up 88% on the four before (8). 1 critical against 5. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 4 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 2 | 1 | 0 | | 14 Sep 2026 | 3 | 1 | 0 | | 21 Sep 2026 | 2 | 2 | 0 | | 28 Sep 2026 | 2 | 1 | 0 | | 5 Oct 2026 | 1 | 1 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 10 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 2 | 1 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## miniOrange technologies - [miniOrange SAML SSO - Service Provider](https://junglewise.ai/threats/technologies/miniorange-saml-sso-service-provider): 7 vulnerabilities - [miniOrange 2FA](https://junglewise.ai/threats/technologies/2fa): 5 vulnerabilities - [miniOrange OAuth Single Sign On - SSO (OAuth Client)](https://junglewise.ai/threats/technologies/oauth-single-sign-on-sso-oauth-client): 3 vulnerabilities - [miniOrange OTP Login, Verification and SMS Notifications](https://junglewise.ai/threats/technologies/otp-login-verification-and-sms-notifications): 3 vulnerabilities - [miniOrange OTP Verification](https://junglewise.ai/threats/technologies/otp-verification): 3 vulnerabilities - [miniOrange SAML Single Sign On – SSO Login](https://junglewise.ai/threats/technologies/saml-single-sign-on-sso-login): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "miniOrange vulnerabilities", https://junglewise.ai/threats/vendors/miniorange, 12 November 2026.