9.8

CVE-2026-57807

Medienbericht

WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability

WordPress Single Sign-On (SSO) - Multisite Premium <= 38.5.8 - Missing Authorization

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation.

This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
Mögliche Gegenmaßnahme
WordPress Single Sign-On (SSO) - Multisite Enterprise: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerminiOrange Security Software Pvt Ltd.
≫
Produkt OAuth Single Sign On - SSO (OAuth Client)
Default Statusunaffected
Version <= 38.5.8
Version n/a
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WordPress Single Sign-On (SSO) - Multisite Enterprise
Version *-38.5.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.411
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
audit@patchstack.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-288 Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
03.08.2026 16:28
https://patchstack.com/database/wordpress/plugin/miniorange-oauth-oidc-single-sign-on/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-38-5-8-broken-authentication-vulnerability?_s_id=cve
https://www.wordfence.com/threat-intel/vulnerabilities/id/f74a2cc2-7e92-493a-a245-8b8c67b92059
Third Party Advisory