https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:45:48 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-15013 <p>The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP&#39;s RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.</p> <p>The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP&#39;s RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-15013 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0305 <p><strong>Affected:</strong> CVE-2026-15013 – miniOrange</p> <p>Hello Full Disclosure,</p> <p>I&#39;d like to share an independent lab Proof-of-Concept for CVE-2026-15013.</p> <p>### CVE-2026-15013 – miniOrange SAML SSO &lt;= 5.4.3 Unauthenticated Authentication Bypass</p> <p>SAML Signature Algorithm Confusion vulnerability. An unauthenticated attacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification against the IdP&#39;s public key, allowing full account takeover (including administrators).</p> <p>Root cause: Mo_SAML_Utilities::mo_saml_cast_key() trusts the attacker-controlled SignatureMethod algorithm.</p> <p>PoC (full chain to admin + optional webshell/reverse shell) + Docker lab: https://github.com/zer0dayf/CVE-2026-15013</p> <p>Patched in 5.4.4+ Original finder: lhking (Wordfence) CVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013</p> <p>This repository is for educational and authorized testing purposes only.</p> <p>Regards, zer0dayf https://github.com/zer0dayf _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives &amp; RSS: https://seclists.org/fulldisclosure/</p> <p><strong>Affected:</strong> CVE-2026-15013 – miniOrange</p> <p>Hello Full Disclosure,</p> <p>I&#39;d like to share an independent lab Proof-of-Concept for CVE-2026-15013.</p> <p>### CVE-2026-15013 – miniOrange SAML SSO &lt;= 5.4.3 Unauthenticated Authentication Bypass</p> <p>SAML Signature Algorithm Confusion vulnerability. An unauthenticated attacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification against the IdP&#39;s public key, allowing full account takeover (including administrators).</p> <p>Root cause: Mo_SAML_Utilities::mo_saml_cast_key() trusts the attacker-controlled SignatureMethod algorithm.</p> <p>PoC (full chain to admin + optional webshell/reverse shell) + Docker lab: https://github.com/zer0dayf/CVE-2026-15013</p> <p>Patched in 5.4.4+ Original finder: lhking (Wordfence) CVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013</p> <p>This repository is for educational and authorized testing purposes only.</p> <p>Regards, zer0dayf https://github.com/zer0dayf _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives &amp; RSS: https://seclists.org/fulldisclosure/</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0305 https://vulnerability.circl.lu/vuln/ghsa-p847-q8vx-c3fg <p>The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP&#39;s RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.</p> <p>The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP&#39;s RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.</p> https://vulnerability.circl.lu/vuln/ghsa-p847-q8vx-c3fg