CVE Catalog
CVE-2026-77995
CriticalCVSS 10.0Summary
Joomla Extension - miniOrange OAuth Client versions below 3.2.0 contain an arbitrary account takeover vulnerability. Manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
Risk Assessment
The risk includes complete takeover of user accounts, including administrators, potentially leading to unauthorized data access, content modification, and compromise of the Joomla system integrity.
Recommendation
It is recommended to immediately update the miniOrange OAuth Client extension to version 3.2.0 or later, which fixes this vulnerability.
Original NVD description (English source)
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.