# SAML Single Sign On <= 6.0.0 - Unauthenticated Authentication Bypass via SAML Assertion Replay

- **ID:** WPSEC-2026-1048
- **Plugin:** SAML Single Sign On – SSO Login (`miniorange-saml-20-single-sign-on`), https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/
- **Affected versions:** all versions before 6.1.0
- **Fixed in:** 6.1.0 (Update to 6.1.0 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-294
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/miniorange-saml-20-single-sign-on
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1048/

## Description

The SAML Single Sign On plugin for WordPress is vulnerable to Authentication Bypass via SAML assertion replay in all versions up to, and including, 6.0.0. This is due to the plugin not recording consumed SAML Assertion IDs, so it accepts the same validly signed SAMLResponse more than once. This makes it possible for unauthenticated attackers who obtain a victim's signed SAMLResponse to POST it again and log in as that user. Replay works for the assertion's whole validity window, and indefinitely when assertion time validation is disabled. Exploitation requires the attacker to first capture a valid SAML response.

## References

- https://wpsec.com/vuln/WPSEC-2026-1048/
- https://plugins.svn.wordpress.org/miniorange-saml-20-single-sign-on/tags/6.1.0/
- https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1048/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.