CVE-2026-15013 – miniOrange SAML SSO <= 5.4.3 Unauthenticated Authentication Bypass (PoC)
Öner Efe Güngör ·
Hello Full Disclosure, I'd like to share an independent lab Proof-of-Concept for CVE-2026-15013. ### CVE-2026-15013 – miniOrange SAML SSO <= 5.4.3 Unauthenticated Authentication Bypass SAML Signature Algorithm Confusion vulnerability. An unauthenticated attacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification against the IdP's public key, allowing full account takeover (including administrators). Root cause: Mo_SAML_Utilities::mo_saml_cast_key() trusts the attacker-controlled SignatureMethod algorithm. PoC (full chain to admin + optional webshell/reverse shell) + Docker lab: https://github.com/zer0dayf/CVE-2026-15013 Patched in 5.4.4+ Original finder: lhking (Wordfence) CVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013 This repository is for educational and authorized testing purposes only. Regards, zer0dayf https://github.com/zer0dayf _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/