# A loose PHP comparison let attackers sign in as WordPress admin through SAML

Source: https://startwithidentity.com/blog/2026-08-25-miniorange-saml-plugin-signature-bypass-exploited/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Attackers are exploiting two unauthenticated authentication bypasses in the Xecurify [miniOrange](https://startwithidentity.com/vendors/iam/miniorange/) SAML 2.0 Single Sign On plugin for WordPress. CVE-2026-61979 (CVSS 8.1) is a signature algorithm confusion; CVE-2026-15981 (CVSS 9.8) accepts malformed signatures. Both trace to `mo_saml_validate_signature()` performing a loose boolean check on the tri-state integer PHP's `openssl_verify()` returns, so the error value of -1 is read as success. An attacker crafts a [SAML](https://startwithidentity.com/standards/saml-2-0/) response with a deliberately broken signature, triggers an OpenSSL error, and is signed in as administrator. Fixed in 17.0.5 and 17.0.6. DigitalOcean's security team found them after spotting odd admin sessions from outside its network.

## Why it matters

This is the classic SAML failure mode and it keeps recurring because signature validation sits in application code rather than in the protocol. The bug is not cryptographic: OpenSSL did its job and returned an error. The plugin asked "is this truthy" instead of "is this exactly 1," and -1 is truthy. Any implementation that wraps a tri-state C-style return in a boolean check has the same latent flaw. If you maintain a [SAML](https://startwithidentity.com/standards/saml-2-0/) service provider, audit for exact-match comparison on verification results, reject responses with unexpected algorithms rather than falling through, and pin the expected signing certificate. Exploitation so far looks like opportunistic scanning from six IPs with public proof-of-concept code, which means unpatched instances get found quickly. Related: [SAML vs OIDC](https://startwithidentity.com/guides/fundamentals/saml-vs-oidc/).

Source: [The Hacker News](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html)