WordPress Frontegg SAML SSO plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Plugin Frontegg SAML SSO versions = 1.0.1...

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

CVE-2026-75800

The Frontegg SAML SSO WordPress plugin (versions ≤ 1.0.1 ) fails to verify the signature or issuer of SAML authentication responses before establishing a session. This allows unauthenticated attackers to log in as any user—including administrators—and to create arbitrary accounts, effectively an ...

EUVD-2026-76816

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

CVE-2026-75800 Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

CVE-2026-75800 Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

PT-2026-90556

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts...

Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

MAL-2025-4725 Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

Malicious code in frontegg-angular-sanity-check (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f18cbdaf7836cc4a267525da5ee029eb20efcf6f1ef0e2208a62448a14ef8f Any computer that has this package installed or running should be considered...

Malicious code in frontegg-react-sanity-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb25e4621d231dcfb19174b3d68e319d416128e938f699d683cd4cd436f0fd10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8458 Malicious code in frontegg-react-sanity-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb25e4621d231dcfb19174b3d68e319d416128e938f699d683cd4cd436f0fd10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in next-with-frontegg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 251ac37afbe61350facc80a00faa97821168ad425857f580f6fa33910fbd78eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-621 Malicious code in next-with-frontegg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 251ac37afbe61350facc80a00faa97821168ad425857f580f6fa33910fbd78eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frontegg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc38523beb96cdde6acde02f9c3bd3ff0c0b5f5fbee032f8d4c2ea9e0aae6bdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frontegg-template-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ad88eae56a12311370457653016e421ba49ec99ce33c5e404d7710c57de68b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3219 Malicious code in frontegg-template-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ad88eae56a12311370457653016e421ba49ec99ce33c5e404d7710c57de68b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3217 Malicious code in frontegg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc38523beb96cdde6acde02f9c3bd3ff0c0b5f5fbee032f8d4c2ea9e0aae6bdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frontegg-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8f178114efbe21e062c2f4f30e82d413adeef06ec35e636e38b9d5fabf5f2c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3218 Malicious code in frontegg-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8f178114efbe21e062c2f4f30e82d413adeef06ec35e636e38b9d5fabf5f2c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...