Description

Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-17T14:17:15.263Z",
  "pubdate": "2026-09-17T14:17:15.263Z",
  "executiveSummary": "This vulnerability is classified as an Unauthenticated Broken Authentication flaw affecting Headless Single Sign On versions 1.7.0 and below.\nThe vulnerability allows an unauthenticated remote attacker to bypass identity verification mechanisms, effectively assuming the identity of arbitrary users, including those with administrative privileges, without requiring valid credentials.\nThe defect resides within the core authentication logic of the Headless Single Sign On framework, which fails to correctly validate the integrity and authenticity of the authentication state during the login lifecycle.\nSuccessful exploitation poses a critical risk to the confidentiality, integrity, and availability of protected systems, as unauthorized actors can gain full access to sensitive user data and application functions.\nThe exploit does not require prior knowledge of user accounts or internal credentials, significantly lowering the barrier to entry for potential attackers.\nExposure of this vulnerability on network-facing infrastructure necessitates immediate remediation to prevent widespread account takeover and potential lateral movement within the target environment.",
  "technicalDetails": "The vulnerability originates from a flaw in the session management and authentication verification routines within the Headless Single Sign On plugin. Specifically, the implementation fails to enforce a cryptographically secure validation of the identity provider response or the local session creation process when processing login requests.\nIn affected versions (<= 1.7.0), the authentication component accepts manipulated or malformed authentication tokens that are improperly handled by the backend logic. Because the application logic does not strictly bind the authentication session to a verified server-side identity assertion, it is possible to inject arbitrary user identifiers into the session initialization flow.\nThe attack flow typically involves an attacker intercepting or crafting a specific HTTP request directed at the plugin's authentication endpoint. By bypassing the intended identity verification step—often by manipulating header values, session state parameters, or failing to provide valid credentials while maintaining a specific state transition—the attacker forces the plugin to issue a valid, authenticated session cookie.\nThe root cause is a failure in the trust boundary between the identity assertion layer and the session persistence layer. The vulnerable component fails to re-authenticate the incoming session request against the configured Identity Provider (IdP) or internal user database before granting access.\nThis vulnerability is accessible over the network without any authentication or privilege requirements, as the entry point is exposed prior to the enforcement of standard session controls.\nPost-exploitation, the attacker gains an authenticated session corresponding to a victim user ID. If the attacker targets a known administrator username, they gain full administrative control over the application. The impact includes unauthorized access to private data, modification of security configurations, and the potential to execute privileged operations as an authenticated user.\nThere are no requirements for pre-existing knowledge of the user's password, as the flaw resides in the logic that handles authentication success criteria, rather than the credential verification process itself."
}