A loose PHP comparison let attackers sign in as WordPress admin through SAML
Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signature. Both are under active exploitation.
Attackers are exploiting two unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. CVE-2026-61979 (CVSS 8.1) is a signature algorithm confusion; CVE-2026-15981 (CVSS 9.8) accepts malformed signatures. Both trace to mo_saml_validate_signature() performing a loose boolean check on the tri-state integer PHP's openssl_verify() returns, so the error value of -1 is read as success. An attacker crafts a SAML response with a deliberately broken signature, triggers an OpenSSL error, and is signed in as administrator. Fixed in 17.0.5 and 17.0.6. DigitalOcean's security team found them after spotting odd admin sessions from outside its network.
Why it matters
This is the classic SAML failure mode and it keeps recurring because signature validation sits in application code rather than in the protocol. The bug is not cryptographic: OpenSSL did its job and returned an error. The plugin asked "is this truthy" instead of "is this exactly 1," and -1 is truthy. Any implementation that wraps a tri-state C-style return in a boolean check has the same latent flaw. If you maintain a SAML service provider, audit for exact-match comparison on verification results, reject responses with unexpected algorithms rather than falling through, and pin the expected signing certificate. Exploitation so far looks like opportunistic scanning from six IPs with public proof-of-concept code, which means unpatched instances get found quickly. Related: SAML vs OIDC.
Source: The Hacker News
Related on Start with Identity
- BlogA Check Point SmartConsole flaw hands out full admin tokens to unauthenticated attackers
CVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Managem
- BlogA CVSS 10.0 Metabase zero-day handed admin access through the password reset endpoint
CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's password reset endpoint and take administrative control. It was exploited as a zer
- BlogA SharePoint JWT validation bug let unauthenticated attackers become any user, including admins
CVE-2026-55040 (CVSS 9.1) let a remote, unauthenticated attacker who knows a target's Active Directory SID or user principal name forge a valid session as that
- PodcastA Digital Identity Digest
Short weekly episodes from standards veteran Heather Flanagan that "translate geek to human" on identity standards, wallets, and the web platform.
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.