CVE-2026-82183: OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

Q: Which accounts can an attacker access or create through this issue?

An unauthenticated attacker can log in as an arbitrary non-administrator user and can create new accounts. The provided information does not indicate that administrator accounts can be impersonated.

Q: What must an attacker have to exploit the vulnerability?

The attacker does not need to authenticate first. Exploitation relies on the plugin's Steam single sign-on flow accepting an unverified identity assertion.

Q: Which plugin versions are affected?

OAuth Single Sign On versions before 7.0.1 are affected. The reported vulnerable range includes 6.25.0 through 7.0.0.

Published Sep 2, 2026

Updated

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Affected Software

1 affected component

WordPress OAuth Single Sign On<7.0.1

Event History

Sep 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which accounts can an attacker access or create through this issue?

An unauthenticated attacker can log in as an arbitrary non-administrator user and can create new accounts. The provided information does not indicate that administrator accounts can be impersonated.

What must an attacker have to exploit the vulnerability?

The attacker does not need to authenticate first. Exploitation relies on the plugin's Steam single sign-on flow accepting an unverified identity assertion.

Which plugin versions are affected?

OAuth Single Sign On versions before 7.0.1 are affected. The reported vulnerable range includes 6.25.0 through 7.0.0.