A critical authorization bypass vulnerability in the miniOrange OAuth Client extension for Joomla enables unauthenticated attackers to hijack user sessions, including those of administrative accounts.

This flaw stems from an authorization bypass through a user-controlled key (CWE-639), where improper handling of cookie values allows an attacker to masquerade as any registered user without authentication.

With a CVSS score of 10, this vulnerability represents the highest level of risk, as it allows for trivial and complete compromise of the Joomla instance. An attacker gaining administrative access via this method could exfiltrate sensitive user data, modify site content, or establish persistent backdoors, leading to severe reputational damage and regulatory non-compliance.

Immediate Action: Update the miniOrange OAuth Client extension to version 3.2.0 or later immediately. If an update is not immediately available, disable the extension to prevent unauthorized session hijacking.

Proactive Monitoring: Audit Joomla session logs and user authentication logs for anomalous patterns or logins originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and validate incoming cookie data, ensuring that session identifiers are not easily manipulated by external actors.

Public Exploit Available: Unknown

Due to the critical severity and the ease of exploitation, immediate patching is mandatory. Administrators should verify the integrity of their user database following any update to ensure no unauthorized accounts were created or modified during the period the site was vulnerable.