A loose PHP comparison let attackers sign in as WordPress admin through SAML
Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signature. Both are under active exploitation.
Attackers are exploiting two unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. CVE-2026-61979 (CVSS 8.1) is a signature algorithm confusion; CVE-2026-15981 (CVSS 9.8) accepts malformed signatures. Both trace to mo_saml_validate_signature() performing a loose boolean check on the tri-state integer PHP's openssl_verify() returns, so the error value of -1 is read as success. An attacker crafts a SAML response with a deliberately broken signature, triggers an OpenSSL error, and is signed in as administrator. Fixed in 17.0.5 and 17.0.6. DigitalOcean's security team found them after spotting odd admin sessions from outside its network.
Why it matters
This is the classic SAML failure mode and it keeps recurring because signature validation sits in application code rather than in the protocol. The bug is not cryptographic: OpenSSL did its job and returned an error. The plugin asked "is this truthy" instead of "is this exactly 1," and -1 is truthy. Any implementation that wraps a tri-state C-style return in a boolean check has the same latent flaw. If you maintain a SAML service provider, audit for exact-match comparison on verification results, reject responses with unexpected algorithms rather than falling through, and pin the expected signing certificate. Exploitation so far looks like opportunistic scanning from six IPs with public proof-of-concept code, which means unpatched instances get found quickly. Related: SAML vs OIDC.
Source: The Hacker News
Related on Start with Identity
- BlogA Check Point SmartConsole flaw hands out full admin tokens to unauthenticated attackers
CVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Managem
- BlogA CVSS 10.0 Metabase zero-day handed admin access through the password reset endpoint
CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's password reset endpoint and take administrative control. It was exploited as a zer
- BlogA SharePoint JWT validation bug let unauthenticated attackers become any user, including admins
CVE-2026-55040 (CVSS 9.1) let a remote, unauthenticated attacker who knows a target's Active Directory SID or user principal name forge a valid session as that
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- ArticleB2B SaaS Security Tools: The Stack That Gets You Through Enterprise Procurement
The security tooling a B2B SaaS product actually needs to close enterprise deals in 2026, from enterprise SSO and SCIM to audit logs, secrets scanning, and acce
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr