DEV Community

Anoymask
Anoymask

Posted on

Two Vulnerabilities Bypassing Signature Verification in miniOrange SAML SSO

#security #threatintel

1. Basic Information

  • Article Title: One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
  • Publisher: Patchstack / DigitalOcean Security
  • Publication Date: 2026-08-21
  • Updated Date: N/A
  • Severity: Critical
  • Original Article: Patchstack
  • Related Sources: BleepingComputer, NVD - CVE-2026-15981
  • Related Entities:
    • Malware: None
    • Groups: Not identified in public reports
    • CVEs: CVE-2026-61979, CVE-2026-15981
    • Products: miniOrange SAML 2.0 Single Sign On for WordPress (Free and six paid editions), WordPress, SAML, PHP OpenSSL

2. Executive Summary

Two authentication bypass vulnerabilities allow an attacker to trick the miniOrange plugin into accepting a forged SAML response. This lets the attacker log in as an existing WordPress administrator without a password or IdP compromise. Real-world attacks successfully obtained administrator session cookies.

3. Attack Flow

1. CVE-2026-61979: Signature Algorithm Confusion

  1. The attacker checks the miniOrange SAML SSO endpoint on the target site and the RSA public key published in the IdP metadata.
  2. The attacker sets SignatureMethod to HMAC-SHA1 in the SAML response and signs a fake SAML assertion using the public RSA key's PEM string as the HMAC shared secret.
  3. The plugin accepts the algorithm specified by the SAML response and treats the RSA public key as an HMAC key.
  4. The forged signature is judged as valid, and a WordPress authentication cookie for the specified user is issued.

2. CVE-2026-15981: Misjudgment of OpenSSL Errors

  1. The attacker sends a SAML response containing an existing user's NameID and an invalid signature that triggers an internal OpenSSL error.
  2. PHP's openssl_verify() returns 1 for a valid signature, 0 for a mismatch, and -1 for a processing error.
  3. The plugin does not strictly check the return value and evaluates it as a boolean. It treats -1, which is truthy in PHP, as a successful signature.
  4. The signature verification passes, and a WordPress authentication cookie for the specified user is issued.

3. Real-World Attack Observations

  1. DigitalOcean detected abnormal activity where an external network tried to use a WordPress administrator session.
  2. The attacker had already obtained an administrator session cookie through the authentication bypass.
  3. Subsequent operations were blocked because management actions on /wp-admin were restricted to trusted networks.
  4. Scans targeting miniOrange SSO endpoints were observed from multiple IP regions, indicating opportunistic and indiscriminate attacks.

4. Attacker Position and Execution Location

  • The attacker sends a crafted SAML response from the internet to the public miniOrange SAML Assertion Consumer Service on WordPress.
  • Signature verification and WordPress authentication cookie issuance take place inside the PHP/WordPress process on the victim site.
  • Stealing IdP accounts, IdP private keys, or WordPress passwords is not required. The IdP public key used in CVE-2026-61979 is normally public information.
  • Subsequent actions using the acquired cookie take place on the WordPress admin screen. In the DigitalOcean case, this was blocked by network restrictions on the admin screen.

5. Perspectives of Victims and Administrators

Victims

  • No user action, MFA approval, or password entry is required. There are usually no visible signs on the victim's screen.
  • The impersonated administrator may see an admin session created at a time and from an IP address they did not use.

Administrators and SOCs

  • Successful SAML logins and admin cookie issuance may appear on the WordPress side even though there are no corresponding successful authentications on the IdP side.
  • POST requests to the miniOrange SSO endpoint from unauthorized source IPs, or subsequent access to /wp-admin, serve as clues.
  • Because the seven editions share the same WordPress plugin slug but have different version numbers, a simple check like "version 5.4.5 or higher" can miss vulnerabilities in paid editions.
  • Paid editions may not show update notifications in the WordPress dashboard, requiring manual uploads.

6. Conditions for Success and Failure

Success Conditions

  • A vulnerable edition and version of miniOrange SAML SSO is active on the target WordPress site and processing SAML logins.
  • The attacker successfully delivers the SAML response to the Assertion Consumer Service.
  • For CVE-2026-61979, the attacker obtains the IdP public key and creates a forged response using HMAC-SHA1.
  • For CVE-2026-15981, the attacker creates an invalid signature that causes openssl_verify() to return -1.
  • The attacker specifies an existing WordPress user to impersonate and uses the issued cookie in the admin console.

Failure Conditions

  • Update to the patched version corresponding to the edition in use: Free (5.4.5+), Premium single-site (13.0.4+), Standard (17.0.6+), multisite Premium/Enterprise/All-Inclusive (20.2.8+), single-site Enterprise/All-Inclusive (26.0.3+), VIP single-site (32.0.8+), and VIP multisite (35.0.7+).
  • If immediate updates are not possible, apply the temporary fixes mentioned in the article: rejecting HMAC-SHA1 and strictly comparing openssl_verify(...) === 1.
  • Apply a virtual patch using a WAF on the SAML endpoint to block known forgery patterns.
  • Restrict the WordPress admin screen to a VPN or trusted network to block management actions even if cookies are stolen.

7. What Happens on Success

  • The attacker obtains authentication sessions for any existing WordPress user, including administrators.
  • The attacker can modify posts, settings, users, plugins, and themes as an administrator, leading to data theft or site defacement.
  • In configurations where code-executing plugins or themes can be installed or edited through WordPress admin features, this can lead to remote code execution (RCE) and persistence on the server (Inference).
  • In the DigitalOcean case, the attacker successfully obtained admin cookies, but management actions were blocked by trusted network restrictions.

8. Observable Logs

Email

  • No records indicate email is used as an initial access vector. Notifications from WordPress regarding admin changes, new users, or plugin updates serve as secondary evidence of subsequent compromise.

Proxy / SWG / DNS

  • POST requests from external IPs to the WordPress miniOrange SAML Assertion Consumer Service.
  • Contact with the target endpoint from scan source IPs noted in security reports.
  • Timeline showing access to /wp-admin from the same source immediately after a SAML POST request.

Endpoint / EDR

  • SAML processing and admin cookie issuance logs in Web server and WordPress logs.
  • Subsequent changes to plugins, themes, or PHP files, creation of unknown administrators, or web shell deployment.
  • Signature processing errors in PHP/OpenSSL error logs. For CVE-2026-15981, errors can occur simultaneously with successful authentication.

Identity / IdP

  • Absence of corresponding IdP sign-in events for SAML logins on the WordPress side.
  • SAML responses using HMAC-SHA1, which is not permitted by the organization.
  • Discrepancies between WordPress admin session times/users and IdP authentication/MFA times.

SaaS / Cloud

  • WAF, load balancer, and administrative audit logs from WordPress hosting environments.
  • Cloud firewall and trusted network control logs blocking /wp-admin (such as in DigitalOcean).
  • Results of auditing editions and versions, not just plugin slugs, across multiple WordPress assets.

Network

  • Unusual and repeated access to SAML endpoints from the internet.
  • Continuous access to admin screens, the WordPress REST API, and file uploads after a successful SAML POST.
  • Communications from web servers to new external destinations should be investigated as potential subsequent code execution.

9. Attack Success Assessment

  • Attack Attempt Observed (Success Unconfirmed): Only scans to the miniOrange SSO endpoint, suspected forged SAML responses, or contact from article-referenced IPs are confirmed.
  • User Action Confirmed: Neither vulnerability requires user interaction. Do not rely on the presence of user action as a success condition.
  • Initial Execution Confirmed: Evidence confirms SAML responses were processed through vulnerable signature verification routes and the attacker-specified NameID proceeded to user resolution.
  • Malware Execution or Authentication Success Confirmed: Confirmed issuance of WordPress authentication cookies, creation of admin sessions from attacker IPs, or successful access to /wp-admin.
  • Data Theft or Session Compromise Confirmed: Confirmed that admin cookies were used by the attacker and data was retrieved from the admin screen or API.
  • Subsequent Compromise Confirmed: Confirmed user/setting/post modifications, plugin/theme installations, PHP changes, web shells, or outbound C2 communications.

10. Investigation Playbook

Trigger

  • WordPress SAML admin logins without corresponding IdP authentication.
  • Repeated POST requests to miniOrange SSO endpoints from article-referenced or unknown IPs.
  • /wp-admin session attempts from outside trusted networks.
  • Asset scans detecting vulnerable versions of miniOrange.

Initial Verification

  • Identify the WordPress site, plugin slug, edition, exact version, SAML configuration, and IdP.
  • Cross-reference with the article's table of fixed versions by edition; do not determine safety based solely on version number magnitudes.
  • Align SAML POST requests, cookie issuance, /wp-admin access, and IdP sign-ins by user and timestamp.

Endpoint

  • Preserve logs from web servers, WordPress, PHP, and WAFs, along with plugin files from the relevant timeframe.
  • Check for changes to plugins, themes, uploads, admin users, cron jobs, wp_options, and authentication keys.
  • Inspect child processes, PHP executions, outbound communications, and web shells generated after admin sessions.

Identity & Cloud

  • Cross-reference WordPress sessions with IdP sign-ins and MFA events to extract unsupported successes.
  • Invalidate all WordPress authentication cookies and rotate administrator credentials and WordPress salts/keys.
  • Verify source IPs for SAML endpoints and /wp-admin across WAFs, CDNs, load balancers, and cloud firewalls.

Subsequent Actions

  • Track user creation, permission changes, post defacements, plugin/theme modifications, and file changes originating from the admin session.
  • Compare WordPress databases and backups to determine the scope of tampering and data access.
  • Search for the same source IPs, User-Agents, and SAML characteristics across other WordPress sites.

Containment

  • Move target sites to maintenance mode or restrict admin access to trusted networks, and manually update vulnerable plugins to patched versions.
  • If updates are impossible, disable the plugin or apply temporary fixes and WAF virtual patches from the article.
  • Invalidate sessions, change auth keys and admin passwords, and remove unknown administrators or added code.
  • Do not conclude that IdP private keys were leaked based solely on CVE-2026-61979, unless evidence of private key compromise exists.

Severity Tiers

  • Scans / forged SAML delivery only
  • Evidence of signature verification bypass
  • WordPress cookie / admin session established
  • Admin screen / API usage
  • Data retrieval / setting or code modifications
  • Server code execution / persistence

11. Defense and Detection Ideas

Single Events

  • SAML responses specifying HMAC-SHA1 and verifying using the IdP's RSA public key.
  • WordPress authentication successes occurring simultaneously with openssl_verify() errors.
  • Admin cookie usage from outside trusted networks.
  • Successful WordPress SAML logins with no corresponding IdP logs.

Time-Series Correlation

  • SAML POST -> PHP/OpenSSL errors -> Cookie issuance -> /wp-admin access.
  • Repeated probing of SSO endpoints from unknown IPs -> Admin session attempts for multiple users.
  • Admin session establishment -> Plugin/theme modifications -> PHP file creation -> Outbound traffic.

Threat Hunting Perspectives

  • Article-referenced IPs, abnormal SignatureMethod values, invalid signatures, and unusual SAML response sizes.
  • WordPress user sessions lacking corresponding IdP sign-ins.
  • Vulnerable versions across the 7 editions (use the article's non-contiguous version ranges, not a single continuous version range).
  • Paid miniOrange SAML SSO editions lacking update notifications.

Log Gaps

  • Standard WordPress logs may not fully record auth cookie issuers or SAML verification reasons.
  • If CDNs or WAFs do not store request bodies, post-incident verification of SAML response signature methods becomes impossible.
  • Without inventory tracking for paid editions and versions, standard vulnerability databases may yield false assessments.
  • Even when admin actions are blocked after cookie theft, records of cookie issuance itself may be missing.

Priority Actions

  • Inventory all miniOrange editions and versions across all WordPress instances and update them to patched versions or higher.
  • Restrict /wp-admin to VPNs or trusted networks, separating SAML authentication controls from administrative access controls.
  • Correlate IdP authentication with WordPress sessions in a SIEM to detect unsupported successes.
  • Enforce an allowlist of asymmetric algorithms for SAML signatures and reject HMAC.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-61979 allows attackers to forge signatures by combining an attacker-specified HMAC-SHA1 algorithm with the IdP's RSA public key PEM.
  • CVE-2026-15981 treats error return values (-1) from openssl_verify() as successful due to loose PHP boolean evaluations.
  • Both vulnerabilities allow attackers to impersonate existing WordPress users without authentication or user interaction.
  • DigitalOcean reproduced authentication bypasses using Standard version 16.1.9 and detected instances where attackers obtained admin cookies.
  • In DigitalOcean's case, /wp-admin was restricted to trusted networks, blocking subsequent management actions.
  • The 7 editions share the same slug but have independent version series; the vulnerability ranges of paid editions were not reflected in initial public databases.

Inference

  • If admin cookies are accessible, attackers will likely attempt remote code execution and persistence through standard WordPress admin features, though this was not observed in the DigitalOcean case.
  • Scans from multiple regions indicate opportunistic scanning across plugin-utilizing sites rather than targeted attacks against specific organizations.
  • Japanese WordPress sites and general enterprise environments using the same plugins and vulnerable versions are technically impacted.

Hypothesis

  • Indiscriminate exploitation attempts may increase following the release of public PoCs and comprehensive paid edition impact ranges.
  • Compromised sites may experience subsequent progression into SEO spam, payment data theft, or web shell deployment after admin sessions are acquired, though initial reports did not specify secondary payloads.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: High) — Sending crafted responses to public WordPress SAML endpoints to exploit signature verification flaws.
  • T1606.002 Forge Web Credentials: SAML Tokens (Confidence: High) — Forging SAML responses by leveraging HMAC key confusion or OpenSSL error misjudgment.
  • T1078 Valid Accounts (Confidence: Medium) — Utilizing existing administrator WordPress sessions issued via forged SAML for subsequent actions. Note that legitimate passwords are not stolen.

14. Unknowns and Additional Investigation

  • Primary CVEs used in actual exploitation, along with complete characteristics of observed SAML responses, User-Agents, and paths.
  • Number of organizations whose admin cookies were acquired, successful compromise counts, and the presence of subsequent actions or data theft.
  • Relationships between attacker groups and scan source IPs, along with infrastructure reuse patterns.
  • Exact versions patching both CVEs independently across each paid edition. (Article tables show minimum versions closing both.)
  • Whether existing sessions automatically expire after plugin updates.
  • Usage counts and external exposure metrics for miniOrange editions in general corporate environments.

15. Impact on SOCs and General Enterprises

  • Corporate websites using SAML integration between WordPress and Entra ID, Okta, or Google Workspace can have their WordPress administrator sessions compromised even if the IdP is not compromised.
  • Because paid editions have version numbers higher than the Free edition, generic scanners may falsely report them as safe by comparing them against "5.4.5 or higher." Edition-specific inventories are required.
  • Network restrictions on /wp-admin serve as an effective defense that successfully stopped subsequent actions even after authentication bypass occurred, making it a viable measure for enterprise environments.
  • SOCs must collect WordPress-side SAML successes, cookies, and management actions—not just IdP logs—to correlate "WordPress SSO successes without IdP authentication."
  • If corporate sites, career pages, customer portals, or e-commerce sites utilize this plugin via managed service providers, verification of editions, versions, and manual updates is necessary.

16. Summaries by Target Audience

For SOCs

Correlate WordPress SAML successes without IdP authentication, admin cookie usage immediately following SAML POSTs, and /wp-admin access from outside trusted networks. Distinguish between cookie acquisition and subsequent administrative actions or code execution.

For Administrators

Verify miniOrange editions and versions instead of relying solely on slugs, and manually update to patched versions or higher. Restrict /wp-admin to VPNs or allowed IP ranges, invalidate all sessions, and audit files and administrator accounts.

For End Users

Because these attacks succeed without user clicks or MFA approvals, prevention by end users alone is difficult. Administrators should immediately report unexpected login notifications, site setting changes, post modifications, or user updates.

Top comments (0)