Description

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T06:17:19.987Z",
  "pubdate": "2026-09-02T06:17:19.987Z",
  "executiveSummary": "The OAuth Single Sign On WordPress plugin, in versions prior to 7.0.1, contains a critical authentication bypass vulnerability within its Steam integration flow.\nThe vulnerability stems from a failure to perform server-side validation of the identity assertion returned by the Steam OpenID provider.\nThis flaw allows unauthenticated remote attackers to impersonate any non-administrative user on the WordPress site without possessing valid credentials.\nFurthermore, the vulnerability permits the unauthorized creation of new user accounts, potentially leading to unauthorized data access and integrity compromise.\nThe vulnerability poses a severe risk to site security and user data privacy, as it undermines the trust model of the single sign-on implementation.\nExploitation does not require prior authentication or elevated privileges, making it accessible to any attacker capable of initiating the OAuth/OpenID handshake process.",
  "technicalDetails": "The vulnerability resides in the OAuth Single Sign On plugin's handling of the OpenID response returned by the Steam platform during the authentication handshake.\nSpecifically, the plugin fails to cryptographically verify the authenticity of the assertion returned by the Steam OpenID service before trusting the identity claim contained within the payload.\nIn a secure OpenID implementation, the Service Provider must perform a secondary verification step by sending the assertion back to the identity provider (Steam) to confirm that the assertion was genuinely issued and has not been tampered with by the user agent.\nBecause this verification is omitted, an attacker can intercept the authentication response or craft a malicious response mimicking the Steam assertion structure.\nBy manipulating the identity parameters within the unverified assertion, the attacker can force the plugin to recognize them as an arbitrary existing user associated with that identity provider.\nThe attack flow follows these steps: 1) The attacker initiates a login request through the plugin's Steam SSO functionality; 2) The attacker intercepts or mimics the callback request containing the identity assertion; 3) The attacker modifies the identity assertion to reflect the target user's identification details; 4) The plugin processes the assertion without validation, erroneously treating the request as a successful authentication for the specified target; 5) The plugin establishes a session for the attacker, granting them the privileges and access rights of the impersonated user.\nThis vulnerability is classified as an improper authentication flaw. It affects all versions of the OAuth Single Sign On plugin prior to 7.0.1.\nThe impact is significant, as it enables unauthorized account takeovers and account registration, which can be leveraged for further exploitation, such as unauthorized data exfiltration or site configuration changes if the targeted non-administrator accounts possess sensitive, non-administrative capabilities.\nThe lack of integrity checks on the identity assertion effectively renders the Steam SSO authentication mechanism insecure, as any user-supplied assertion is treated as trusted input by the plugin."
}