miniOrange — Vulnerabilities & Security Advisories 29

miniOrange primarily provides identity and access management solutions, specializing in single sign-on (SSO), multi-factor authentication (MFA), and directory synchronization for enterprise environments. Security audits have identified twenty-nine distinct Common Vulnerabilities and Exposures (CVEs) associated with its software suite, revealing a pattern of critical flaws. These vulnerabilities predominantly involve remote code execution (RCE) and cross-site scripting (XSS), allowing attackers to compromise system integrity or steal user credentials. Additionally, several instances of broken access control and privilege escalation have been documented, enabling unauthorized users to gain administrative rights. The high volume of historical CVEs suggests significant challenges in maintaining secure codebases across its diverse product offerings. While the company actively issues patches, the recurring nature of these critical flaws indicates persistent risks for organizations relying on its authentication infrastructure without rigorous security monitoring and immediate updates.