Skip to content
Sign in
8.1 High

CVE-2026-82183 The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam…

Description

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Affected products and versions

Product Affected versions Fixed in
OAuth Single Sign On 6.25 6.25.0 → < 7.0.1 7.0.1

Other CVEs of OAuth Single Sign On

The 2 CVEs of OAuth Single Sign On →
CVE-2023-1093 The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers… 6.5 Medium
Track this CVE