The vulnerability resides in the signature verification routine of the miniOrange SAML extensions for Joomla. A loose boolean check evaluates PHP’s openssl_verify() return value of -1, which is treated as true, allowing a crafted SAMLResponse with a broken signature to be accepted as valid. This flaw bypasses authentication entirely; an attacker can submit such a response, specify any target user’s NameID, and be logged in as that user. Successful exploitation compromises confidentiality and integrity of all Joomla accounts and jeopardizes site control.

The affected extensions are miniorange.com’s SAML SP Single Sign On – Login with ADFS for Joomla, SAML SSO for Joomla, and SAML SSO login with Google Apps for Joomla. Versions below 6.4 for the ADFS and Google Apps extensions, and below 11.0.2 for the generic SSO extension, are vulnerable.

The CVSS score of 10 marks this flaw as critical, and although its EPSS score is not reported, the lack of a KEV listing does not diminish the potential for exploitation. Attackers can craft requests to the SAML endpoint from any network location; once the malformed SAMLResponse reaches the server, the local server code treats it as a valid signature and grants access immediately. Because the flaw is unauthenticated, no credentials are required to start the exploit, making it especially dangerous for exposed sites.