8.1
Élevée
CVE-2026-82183 The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam…
Description
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OAuth Single Sign On 6.25 | 6.25.0 → < 7.0.1 | 7.0.1 |