← CVE Intelligence

CVE-2026-82183

OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion PUBLISHED

Description (CNA)

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Affected (CNA)

Vendor / productVersions
Unknown / OAuth Single Sign Onaffected 6.25.0 before 7.0.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.