miniorange.com CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL miniorange.com CVE published 2026-08-24

CVE-2026-77995

Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 via cookie value manipulation. This vulnerability allows an attacker to manipulate a cookie value to login as any account, including admin accounts, due to inadequate cookie management and authentication mechanisms. Joomla site administrators and cybersecurity teams should review official advisories and plan for updates or mitigations.