SAML Single Sign On <= 6.0.0 - Unauthenticated Authentication Bypass via SAML Assertion Replay
- ID
- WPSEC-2026-1048
- Plugin
- SAML Single Sign On – SSO Login (miniorange-saml-20-single-sign-on)
- Affected
- all versions before 6.1.0
- Remediation
- Update to 6.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-294
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- SAML Single Sign On on WPSec AttackSurface
- Fix released
- Published
Description
The SAML Single Sign On plugin for WordPress is vulnerable to Authentication Bypass via SAML assertion replay in all versions up to, and including, 6.0.0. This is due to the plugin not recording consumed SAML Assertion IDs, so it accepts the same validly signed SAMLResponse more than once. This makes it possible for unauthenticated attackers who obtain a victim's signed SAMLResponse to POST it again and log in as that user. Replay works for the assertion's whole validity window, and indefinitely when assertion time validation is disabled. Exploitation requires the attacker to first capture a valid SAML response.
References
- https://wpsec.com/vuln/WPSEC-2026-1048/
- https://plugins.svn.wordpress.org/miniorange-saml-20-single-sign-on/tags/6.1.0/
- https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS