OAuth Plugin Privilege Escalation Through Incorrect Assignment

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-120844 represents a critical privilege escalation vulnerability in the miniOrange OAuth Single Sign-On plugin (versions through 7.1.3). The flaw stems from incorrect privilege assignment logic within the OAuth client implementation, allowing attackers to escalate their account permissions beyond their intended authorization level. This vulnerability is particularly dangerous because OAuth plugins are foundational to authentication infrastructure—they sit at the gatekeeping layer where identity and access decisions are made. Organizations using this plugin for federated authentication across Google, Facebook, or Eve Online credentials are at immediate risk, as attackers can bypass authorization checks to gain admin or elevated privileged access, potentially compromising entire user ecosystems and sensitive data.

Casky's 224 matching security skills leverage Claude's extended reasoning to identify the attack patterns underlying MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would observe detection patterns focused on: (1) abnormal privilege transitions in OAuth token claims or role assignments, (2) inconsistencies between requested scopes and granted permissions in authentication logs, (3) unauthorized role modifications following OAuth callback processing, and (4) privilege elevation attempts that bypass standard authorization workflows. The platform would flag behavioral anomalies where low-privilege users suddenly perform high-privilege actions post-authentication, or where OAuth token payloads contain role claims mismatched to the authenticated user's profile. By mapping these indicators to the CWE-266 (Incorrect Privilege Assignment) root cause, Casky enables security teams to distinguish genuine privilege escalation attempts from legitimate authorization flows, reducing alert fatigue while maintaining detection fidelity.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-120844.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-120844

Casky has 224 skills that investigate the attack patterns behind CVE-2026-120844. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn