Auth bypass in Miniorange.com Miniorange Oauth Client Extension For Joomla

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.

Vulnerability class: IDOR (Insecure Direct Object Reference)