CVE-2026-79576: Improper Authentication

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-75807: Improper Authentication

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...

CVE-2026-77995: Authorization Bypass Through User-Controlled Key

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On – OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...

CVE-2026-15013: Improper Verification of Cryptographic Signature

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because MoSAMLUtilities::mosamlcastkey reads the SignatureMethod Algorithm attribute directl...

CVE-2026-57807: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO OAuth Client allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO OAuth Client: from n/a through 38.5.8...

CVE-2025-10753: Missing Authorization

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' opti...

CVE-2025-9485: Improper Verification of Cryptographic Signature

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the...

CVE-2025-10752: Cross-Site Request Forgery (CSRF)

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter base64 encoded app name without any randomness in the OAuth flow. This makes it possible f...

CVE-2025-6003: Incorrect Authorization

The WordPress Single Sign-On SSO plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the .5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data...

Lessons from the Snowflake Breaches

Last week, the notorious hacker gang, ShinyHunters, sent shockwaves across the globe by allegedly plundering 1.3 terabytes of data from 560 million users. This colossal breach, with a price tag of $500,000, could expose the personal information of a massive swath of a live event company's...

Fedora 38 : matrix-synapse (2023-56760afca8)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-56760afca8 advisory. Update to v1.85.2 ---- Update to v1.85.1 ---- Update to v1.85.0 Fixes CVE-2023-32682, CVE-2023-32683 ---- Update to v1.84.1 Tenable has extracted th...

Privilege Escalation

Satellite is vulnerable to privilege escalation. An attacker with an authenticated account on Single sign-on SSO is able to gain elevated privileges of existing local users...

Microsoft Sway Abused in Office 365 Phishing Attack

A highly targeted phishing campaign, with a Microsoft file platform twist, has successfully siphoned the Office 365 credentials of more than 150 executives since mid-2019. Researchers attribute the campaign’s success to two parts: First, it leverages multiple Microsoft file-sharing services to...

Cookies, Single Sign-On, and You

What's the problem? As part of a concerted effort to protect end user privacy and increase browser security, major web browsers have been making changes to their treatment of 3rd party cookies. These changes are designed to cripple ad targeting services that track user behavior online and rely on...