CVE-2026-82183

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

EUVD-2026-69861

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

CVE-2026-82183

The OAuth Single Sign On WordPress plugin, versions 6.25.0 through 7.0.0 , fails to verify the Steam OpenID identity assertion returned during its single sign-on flow. This allows an unauthenticated attacker to log in as an arbitrary non-administrator user or create new accounts. The root cause i...