miniOrange has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 6.5 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- JWT Authentication for WP REST APIs 1
- headless-single-sign-on 1
- ldap_/_active_directory_integration 1
Worst active — by depth score
CVE-2026-62108Critical· 9.8Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.54CVE-2026-89027Medium· 6.5miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplyi…36CVE-2026-81205Medium· 5.3Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection29
miniOrange vulnerabilities
CVEs affecting miniOrange, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-62108Critical· 9.8Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.
CVE-2026-89027Medium· 6.5miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplyi…
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplyi…
CVE-2026-81205Medium· 5.3Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from…