5195 matches found
CVE-2026-61979
Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...
EUVD-2026-57976
Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...
CVE-2026-61979 WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...
CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
EUVD-2026-57947
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28148 WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
CVE-2026-28148
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
EUVD-2026-57946
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
CVE-2026-28008
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...
CVE-2026-28008
CVE-2026-28008 affects the WordPress plugin OAuth Single Sign On – SSO (OAuth Client) for versions ≤ 7.0.0. The vulnerability is described as Unauthenticated Broken Authentication , exposing a high-severity risk with a CVSSv3.1 base score of 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Th...
EUVD-2026-57944
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...
WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by sequenceX0 in WordPress Plugin SAML SP Single Sign On versions = 5.4.3...
CVE-2026-61979: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...
CVE-2026-28149: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28148: Improper Verification of Cryptographic Signature
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
PT-2026-71513
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
PT-2026-71542
Name of the Vulnerable Software and Affected Versions SAML SP Single Sign On versions prior to 5.4.4 Description An unauthenticated privilege escalation flaw allows attackers to sign in as any WordPress user, including administrators. Recommendations Update to a version newer than 5.4.3...
CVE-2026-55987: Incorrect Authorization
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-73420: Incorrect Behavior Order: Validate Before Canonicalize
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...