OAuth Single Sign On – SSO (OAuth Client) <= 7.1.3 - Unauthenticated Authentication Bypass to Account Takeover via SSO Login for Accounts with Empty Email
- ID
- WPSEC-2026-2247
- Plugin
- OAuth Single Sign On – SSO (OAuth Client) (miniorange-login-with-eve-online-google-facebook)
- Affected
- all versions before 7.1.4
- Remediation
- Update to 7.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- OAuth Single Sign On – SSO (OAuth Client) on WPSec AttackSurface
- Fix released
- Published
Description
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Authentication Bypass via the SSO login callback (OAuth1, OAuth 2.0 and OpenID Connect flows) in all versions up to, and including, 7.1.3. This is due to the plugin skipping the asserted-email cross-check when the WordPress account matched by the username claim has an empty stored email address, and then overwriting that account's email with the email asserted by the identity provider. This makes it possible for unauthenticated attackers who control an identity at the configured identity provider whose username claim matches an existing account with no stored email to log in as that account and take it over permanently by replacing its email address. This affects sites that map an email attribute. Administrator accounts are exposed only when administrator SSO is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2247/
- https://plugins.svn.wordpress.org/miniorange-login-with-eve-online-google-facebook/tags/7.1.4/
- https://wordpress.org/plugins/miniorange-login-with-eve-online-google-facebook/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS