Two miniOrange SAML flaws let attackers forge administrator logins. The larger failure was operational: six paid editions could appear patched, receive no dashboard update, and remain invisible to vulnerability databases.