miniOrange
Vulnerability activity for miniOrange: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.8CriticalAug 13, 2026miniOrange Headless Single Sign On DeserializationCVE-2026-28149Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
- 9.8CriticalAug 13, 2026miniOrange Headless Single Sign On Crypto / certificateCVE-2026-28148Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
- 9.8CriticalAug 13, 2026miniOrange OAuth Single Sign On – SSO (OAuth Client) Auth bypass / access controlCVE-2026-28008Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
- 9.8CriticalMay 27, 2026miniorange otp verification Privilege escalationCVE-2026-42731Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.
Top products
- Headless Single Sign On2 CVEs in the last year, 2 critical
- OAuth Single Sign On – SSO (OAuth Client)1 CVE in the last year, 1 critical
- miniorange otp verification1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.