CVE-2026-82183
OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
| Vendor | unknown |
| Product | oauth single sign on |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown oauth single sign on
Be the first to know when new high vulnerabilities affecting unknown oauth single sign on are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / OAuth Single Sign On
6.25.0 < 7.0.1
References
Credits
Pedro Pinho WPScan