Attackers are hitting WordPress sites through miniOrange SAML bypasses

Patchstack tracked CVE-2026-61979 and CVE-2026-15981 in miniOrange SAML 2.0 SSO. Fixes shipped in July, but the advisory covered only the free edition.

Cover image from BleepingComputer’s report on miniOrange WordPress SAML attacks

On August 24 BleepingComputer reported Patchstack’s findings on two authentication bypasses in the miniOrange SAML 2.0 SSO WordPress plugin: CVE-2026-61979 and CVE-2026-15981. Fixes arrived in July, but the public advisory covered only the free edition.

What we know

Patchstack assigned CVE-2026-61979 and CVE-2026-15981 to miniOrange SAML 2.0 SSO.
Fixes shipped in July, but the advisory covered only the free edition.
CVE-2026-61979 forces HMAC-SHA1 and treats the identity provider’s RSA public key as a shared secret.
CVE-2026-15981 treats OpenSSL verify error -1 as success.
DigitalOcean blocked an anomalous administrator on August 16 on Standard 16.1.9.

Takeaways

A July fix did not mean a complete public advisory for paid editions.
Both bugs fail closed verification: one misuses the IdP key, the other ignores an OpenSSL error.
At least one host saw live abuse on August 16.

Source: BleepingComputer

Related reading

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

SecurityAug 263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

All of Pulse

SecurityAugust 24, 20263 min read

Attackers are hitting WordPress sites through miniOrange SAML bypasses

Patchstack tracked CVE-2026-61979 and CVE-2026-15981 in miniOrange SAML 2.0 SSO. Fixes shipped in July, but the advisory covered only the free edition.

What we know

Patchstack assigned CVE-2026-61979 and CVE-2026-15981 to miniOrange SAML 2.0 SSO.
Fixes shipped in July, but the advisory covered only the free edition.
CVE-2026-61979 forces HMAC-SHA1 and treats the identity provider’s RSA public key as a shared secret.
CVE-2026-15981 treats OpenSSL verify error -1 as success.
DigitalOcean blocked an anomalous administrator on August 16 on Standard 16.1.9.

Takeaways

A July fix did not mean a complete public advisory for paid editions.
Both bugs fail closed verification: one misuses the IdP key, the other ignores an OpenSSL error.
At least one host saw live abuse on August 16.

Source: BleepingComputer