Sensitive Data Exposure in miniorange_saml

HIGH 7.5CVE-2021-36786 · GHSA-g485-29gq-6h2h · Published 13/08/2021 · updated 17/06/2026

In short

CVE-2021-36786 is a HIGH (CVSS 7.5) vulnerability affecting miniorange/miniorange-saml, saml (miniorange).
Chance of exploitation in the next 30 days (EPSS): 1.00%, higher than 62.7% of all vulnerabilities.
Fix: update to 1.4.3 or later.

Package	Affected versions	Patched versions
miniorange/miniorange-saml Packagist	`< 1.4.3`	`1.4.3`
saml miniorange	`< 1.4.3`	`1.4.3`

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.

NVD description

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.