Skip to content
Fencer Vulns
critical 9.8

CVE-2022-26493 json

miniOrange SAML Authentication Bypass

published 2022-06-03 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-31051

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.

Patch / fix

  • Xecuify Drupal 8 miniOrange SAML SP 20.3, 30.5, 40.4
  • Xecuify Drupal 9 miniOrange SAML SP 20.3, 30.5, 40.4
  • Xecuify Drupal 7 miniOrange SAML SP 20.2, 30.2, 40.2
  • drupal7 Alpine 3.20, Alpine 3.19, Alpine 3.18 +3 more 7.91-r0

alpine advisories ALPINE-CVE-2022-26493

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • Xecuify Drupal 8 miniOrange SAML SP
  • Xecuify Drupal 9 miniOrange SAML SP
  • Xecuify Drupal 7 miniOrange SAML SP

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.