Description

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T14:16:57.687Z",
  "pubdate": "2026-08-13T14:16:57.687Z",
  "executiveSummary": "An unauthenticated broken authentication vulnerability has been identified in the OAuth Single Sign On (OAuth Client) product affecting versions 7.0.0 and below. This security flaw allows unauthenticated remote adversaries to bypass standard authentication mechanisms provided by the OAuth client implementation.\nThe primary impact of this vulnerability involves unauthorized access to user sessions and protected application resources without requiring valid credentials. Because the flaw stems from improper validation within the Single Sign On (SSO) logic, threat actors can forge or manipulate authentication flows to impersonate legitimate users.\nThe affected system encompasses the OAuth Single Sign On (OAuth Client) component deployed across target environments running vulnerable software versions. The risk implications are severe, potentially leading to complete account takeover, unauthorized data exposure, and integrity violations within the host application.\nExploitation requirements are minimal, as the vulnerability is unauthenticated and exposed over the network. Adversaries do not need prior access, administrative privileges, or interaction with internal systems, making this flaw highly attractive for automated scanning and exploitation.",
  "technicalDetails": "The vulnerability resides within the OAuth Single Sign On (OAuth Client) component, specifically affecting versions 7.0.0 and below. The root cause stems from improper handling, verification, and enforcement of authentication tokens and callback parameters during the OAuth authorization and authentication handshake.\nThe vulnerable component fails to properly validate the authenticity of incoming authorization responses or state parameters, allowing an unauthenticated attacker to inject malicious responses or bypass the cryptographic verification steps required to establish a legitimate user session.\nThe attack vector is entirely network-based, requiring no prior authentication or administrative privileges. An attacker initiates the exploitation process by interacting with the OAuth client authentication endpoints exposed by the vulnerable application.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies the target application utilizing the vulnerable OAuth Single Sign On (OAuth Client) plugin or module. Second, the attacker crafts a malicious authentication response or manipulates the standard OAuth callback sequence, omitting or spoofing required cryptographic assertions and validation tokens.\nThird, the attacker transmits the crafted request directly to the authentication handler of the vulnerable component. Due to insufficient input validation and flawed session establishment logic, the component accepts the fraudulent payload as a valid authentication assertion.\nFinally, the application generates a valid user session for the specified account, granting the attacker unauthorized access with the privileges of the targeted user profile. Post-exploitation impact includes full account compromise, unauthorized retrieval of sensitive data, and potential lateral movement depending on the privileges associated with the compromised user context."
}