A critical Joomla extension vulnerability, CVE-2026-77995, affects miniOrange OAuth Client versions 1.0.0 through 3.1.9. Administrators should update to version 3.2.0 or later without delay, or disable the extension until they can do so.
Joomla sites using the miniOrange OAuth Client extension should treat CVE-2026-77995 as an urgent patching priority. The affected releases can permit unauthenticated remote account takeover, including takeover of administrator accounts; updating to version 3.2.0 or later is the required remediation.
miniOrange OAuth Client vulnerability at a glance
CVE-2026-77995 affects the miniOrange OAuth Client extension for Joomla, supplied by miniorange.com. The CVE record identifies an arbitrary account takeover issue caused by manipulation of a cookie value. According to the record, this can allow an attacker to log in as an arbitrary account, including an administrator account.
The affected range is version 1.0.0 through 3.1.9. The record describes the vulnerable product as miniOrange OAuth Client versions earlier than 3.2.0, making 3.2.0 the first fixed version. Sites using any release in the affected range should update to 3.2.0 or later as soon as their normal change-control process permits. Where an immediate update is not possible, disable the extension to reduce exposure.
| Extension | CVE | Authentication required | Affected versions | Recommended version | CVSS | KEV status |
|---|---|---|---|---|---|---|
| miniOrange OAuth Client for Joomla | CVE-2026-77995 | No | 1.0.0–3.1.9 | 3.2.0 or later | CVSS 4.0: 10.0 Critical | Not currently listed |
The vulnerability is classified as CWE-639, Authorization Bypass Through User-Controlled Key. This classification matters because it describes an authorization decision being made with a value under user control. It should not be described as CWE-287.
Why CVE-2026-77995 is critical
The CVE record for CVE-2026-77995 assigns a CVSS 4.0 base score of 10.0, Critical. Its vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.
For Joomla administrators, the most operationally relevant parts of that assessment are:
- AV:N means the issue is exploitable over the network.
- PR:N means no existing account privileges are required.
- UI:N means the attack does not depend on a site user taking an action.
- The impact metrics are high across confidentiality, integrity and availability for both the vulnerable system and subsequent systems.
Put simply, a site does not need to expose a public registration form or have an administrator interact with an attacker for the issue to matter. If the vulnerable extension is installed and active, the reported impact is the ability to assume arbitrary accounts. Administrator-account takeover is particularly serious because administrator access can change site configuration, users, extensions and content.
The score is a severity assessment under CVSS 4.0. It must not be read as a CVSS 3.1 score or converted into one. Severity also answers a different question from observed exploitation: a critical score describes potential technical impact and attack conditions, while exploitation evidence describes whether malicious use has been authoritatively observed.
Check whether your Joomla site is affected
Start by establishing whether the miniOrange OAuth Client extension is installed on every Joomla environment you manage. Include production, staging, recovery and older hosted copies that may be publicly reachable. Agencies should check all client inventories rather than assuming that one standard extension list covers every site.
- Sign in to the Joomla administrator area using an account you trust.
- Review installed extensions and identify the miniOrange OAuth Client extension for Joomla.
- Record its installed version and whether it is enabled.
- Classify versions from 1.0.0 through 3.1.9 as affected.
- Confirm that any completed remediation leaves the site on version 3.2.0 or a later release.
Names shown in an extension manager can vary with packaging and site language settings. Use the extension's identifying information and installed version rather than relying only on a shortened display name. If an inventory, backup report or deployment manifest identifies the extension but does not state a version, treat it as requiring investigation before considering the site clear.
Do not confuse an extension update with a Joomla core update. Keeping Joomla core current remains good practice, but this advisory concerns a third-party OAuth client extension. A site can run a current Joomla core release and still be affected if its miniOrange OAuth Client installation is below 3.2.0.
Prioritized remediation actions
For an affected site, the most effective response is to remove the vulnerable version from service promptly and then validate the installation. Use a tested maintenance procedure appropriate to the site, especially where OAuth-based sign-in is essential to staff or customer access.
- Confirm the installed version. If it is 1.0.0–3.1.9, mark the site as affected.
- Update to 3.2.0 or later. Obtain the update through the normal trusted extension update path and verify the installed version after the change.
- Disable the extension if patching must wait. Temporarily disabling the miniOrange OAuth Client extension reduces exposure while compatibility testing, backup restoration planning or a maintenance window is arranged.
- Test the legitimate sign-in journey. Confirm that intended OAuth logins, administrative access and any related authentication flows operate as expected after updating or re-enabling the extension.
- Document the change. Record the previous version, target version, time of change, operator and validation result. This provides a useful audit trail for site owners and clients.
Before applying an update, take a current, recoverable backup and ensure the team knows how to restore it. A backup is not a substitute for patching, but it supports a safe change process. If disabling the extension will affect user access, communicate the temporary service impact to relevant users and ensure administrators retain a working, authorised route into the Joomla backend.
Review accounts and privileged changes
Because the stated impact includes arbitrary account takeover, patching should be paired with a focused review of high-privilege accounts. This is a precautionary response to the vulnerability's potential impact, not a claim that a particular site has been compromised.
Review administrator and other high-privilege accounts for unexpected sign-ins, profile changes, new accounts, altered group memberships, changed email addresses or unfamiliar content and configuration changes. Compare findings with the site's normal administration activity and maintenance records. If the review identifies suspicious activity, preserve relevant logs and site records, contain the issue according to the organisation's incident-response process, and assess the scope before making destructive changes.
Where a site uses the extension as part of its authentication design, also review the accounts and access paths that depend on that design. Confirm that privileged accounts are still necessary, that access is assigned deliberately, and that dormant administrative accounts are not left enabled simply for convenience. These checks do not replace the extension update; they help establish confidence that the environment is in the expected state after remediation.
What is known, and what remains unconfirmed
The available authoritative records support a clear remediation recommendation: the vulnerability affects miniOrange OAuth Client for Joomla versions 1.0.0–3.1.9, permits arbitrary account login through cookie-value manipulation, requires no authentication or user interaction, and is fixed in 3.2.0.
There are also important limits to the current evidence. The NVD record currently has a status of Received. This indicates that full NVD analysis is pending, so record details may be updated as that work completes. The CVE and NVD information is sufficient to identify the affected range and the recommended fixed version, but administrators should continue to watch the relevant records and vendor information for updates.
CVE-2026-77995 is not currently listed in the CISA Known Exploited Vulnerabilities catalog according to the reviewed evidence. There is likewise no authoritative confirmation at present that the vulnerability is being exploited in the wild. The absence of a Known Exploited Vulnerabilities listing does not reduce the need to patch a remotely reachable, unauthenticated critical issue; it means only that a KEV listing is not currently supported by the available record.
There is no authoritative basis in the reviewed material to claim ransomware campaign use. This article also does not rely on unverified exploit details. Administrators do not need exploit instructions to act: identify affected installations, update to 3.2.0 or later, or disable the extension until the update is complete.
Build this check into extension security maintenance
This advisory is a practical reminder that extensions handling identity, login state or authorisation deserve prompt version tracking. Maintain an inventory that identifies each extension, its version, whether it is enabled, its business owner and the sites on which it is deployed. That record makes it possible to determine exposure quickly when a vendor or CVE record identifies an affected range.
For Joomla site owners and agencies, a sustainable process includes reviewing extension updates regularly, monitoring official security records for deployed products, testing high-impact updates in a suitable environment where possible, and defining a clear fallback decision when an emergency patch cannot be installed immediately. In this case, the fallback is explicit: disable the vulnerable miniOrange OAuth Client extension until it can be updated to 3.2.0 or later.
Keep the distinction between risk signals clear when communicating with clients and stakeholders. CVSS 4.0 gives CVE-2026-77995 a Critical 10.0 severity rating based on its technical characteristics. A CISA KEV listing would indicate observed exploitation, but this CVE is not currently listed and authoritative exploitation has not been confirmed. Both facts support a calm but urgent response: patch or disable the affected extension now, validate accounts and access, and keep monitoring the authoritative records.
Add comment