CVE-2025-9485

creationtimestamp| type| source ---|---|--- 2025-10-04 03:03:02+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m2dlugcc5e2m 2026-05-30 19:00:10+00:00| seen| Telegram/11w8RI0cRJ2Y5Y75akm2L08lgCZSwunoJ6IZ7hlmRoONww 2026-05-30 21:00:04+00:00| seen|...

CVE-2025-9485

CVE-2025-9485 is an authentication-bypass flaw in the WordPress plugin “OAuth Single Sign On – SSO (OAuth Client)” up to v6.26.12. The root cause is improper verification of cryptographic signatures due to unsafe JWT handling in get_resource_owner_from_id_token, enabling unauthenticated attackers...

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token() vulnerability

Authentication Bypass via getresourceownerfromidtoken vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin OAuth Single Sign On – SSO OAuth Client versions = 6.26.12...