CVE-2026-82183 in OAuth Single Sign On Plugin
Summary
by MITRE • 09/02/2026
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in versions of the OAuth Single Sign On WordPress plugin prior to 7.0.1 represents a critical failure in authentication logic within the Steam OpenID integration module. This flaw stems from a fundamental lack of cryptographic verification for identity assertions returned by the external Identity Provider during the single sign-on process. Specifically, when a user initiates login via Steam, the plugin receives an assertion containing claims about the user's identity. The software fails to validate the signature or integrity of this assertion against Steam’s public keys or expected parameters. This omission allows any actor capable of intercepting or crafting HTTP requests to bypass the authentication mechanism entirely by submitting a forged assertion that claims administrative privileges or arbitrary usernames, effectively rendering the OpenID flow useless as a security control.
From a technical perspective, this issue is classified under CWE-287, which denotes Improper Authentication. The root cause lies in the application’s failure to enforce strict validation of the authentication token provided by the third-party service. In standard OAuth or OpenID Connect flows, the relying party must verify that the assertion was signed by a trusted authority and has not been tampered with during transit. By neglecting this step, the plugin treats any syntactically correct assertion as valid regardless of its origin. This allows attackers to manipulate the identity claims embedded in the request payload. Since WordPress distinguishes between user roles such as administrator, editor, author, and subscriber, an attacker can craft a malicious assertion that specifies a high-privilege role or a specific existing username, thereby gaining unauthorized access without possessing valid Steam credentials for those accounts.
The operational impact of this vulnerability is severe due to the widespread use of WordPress in both personal blogs and enterprise web applications. An unauthenticated remote attacker can exploit this flaw over the network to log into any non-administrator account that already exists on the target site, or create new user accounts with elevated privileges if registration settings allow it. Once authenticated, the attacker gains full control associated with that role. For subscriber-level access, this may lead to data privacy violations and unauthorized content modification. If an administrator account can be compromised through similar logic flaws in other parts of the plugin or by exploiting race conditions during account creation, the entire WordPress installation is at risk. This includes potential defacement, malware injection, database exfiltration, and using the server as a pivot point for further network attacks.
This vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts, where adversaries use legitimate credentials or forged identities to maintain persistence and access within an environment. It also relates to T1621, Authentication Credential Stuffing, although in this case, the attacker does not need valid Steam accounts but rather exploits the trust relationship between WordPress and Steam by forging claims. The lack of signature verification is a classic example of trusting user-supplied data without cryptographic proof of authenticity, which violates fundamental principles of secure system design outlined in OWASP guidelines for authentication mechanisms.
Mitigation strategies must focus on immediate remediation through software updates and configuration hardening. Administrators should upgrade the OAuth Single Sign On plugin to version 7.0.1 or later immediately upon availability, as this release addresses the validation logic flaw by implementing proper signature verification against Steam’s public keys. Until an update is applied, it is advisable to disable the Steam single sign-on option within the WordPress admin dashboard and rely on native WordPress authentication methods which do not suffer from this specific external dependency failure. Additionally, organizations should implement Web Application Firewalls that can detect anomalous patterns in OpenID assertion payloads, although such controls are secondary to patching the underlying code defect. Regular security audits of third-party plugins are essential to identify similar trust boundary violations before they lead to full system compromise.