[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] CVE-2026-15013 – miniOrange SAML SSO <= 5.4.3 Unauthenticated Authentication Bypass (PoC)

Hello Full Disclosure,

I'd like to share an independent lab Proof-of-Concept for CVE-2026-15013.

### CVE-2026-15013 – miniOrange SAML SSO <= 5.4.3 Unauthenticated
Authentication Bypass

SAML Signature Algorithm Confusion vulnerability. An unauthenticated
attacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification
against the IdP's public key, allowing full account takeover (including
administrators).

Root cause: Mo_SAML_Utilities::mo_saml_cast_key() trusts the
attacker-controlled SignatureMethod algorithm.

PoC (full chain to admin + optional webshell/reverse shell) + Docker lab:
https://github.com/zer0dayf/CVE-2026-15013

Patched in 5.4.4+
Original finder: lhking (Wordfence)
CVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013

This repository is for educational and authorized testing purposes only.

Regards,
zer0dayf
https://github.com/zer0dayf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/