CyberRota Analysis
AI-GeneratedThe miniOrange OAuth Client for Joomla versions prior to 3.2.0 is vulnerable to arbitrary account takeover due to cookie value manipulation, enabling attackers to log in as any user, including administrative accounts. This critical vulnerability poses a significant risk to the security of Joomla sites utilizing this extension. Joomla administrators and security teams should prioritize immediate updates to mitigate potential unauthorized access.
Original NVD Description
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.