Unknown Oauth Single Sign On vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Oauth Single Sign On, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

HighCVE-2026-82183unknown · oauth single sign on +1 more1mo agoOAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID AssertionThe OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.EPSS0.38%MediumCVE-2023-1093miniorange · oauth_single_sign_on +2 more3y agoOAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRFThe OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attackEPSS0.33%