Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2025-9485 EUVD-2025-32415GHSA-44hx-mv5h-wj6c

OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

Published Oct 4, 2025 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: cyberlord92 Product: OAuth Single Sign On – SSO (OAuth Client) Category: Web / CMS

Description

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.

Affected products

VendorProductAffectedFixed
cyberlord92 OAuth Single Sign On – SSO (OAuth Client) ≤ 6.26.12 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References