miniOrange OAuth SSO trusts unverified Steam OpenID identities
OAuth Single Sign On through 7.0.0 accepts a Steam OpenID callback and trusts attacker-controlled openid_claimed_id without asking the OpenID provider to validate the assertion. An unauthenticated attacker can therefore submit forged identity material across the login trust boundary. Version 7.0.1 adds mooauth_verify_openid_assertion() and performs the provider check_authentication round trip before accepting the identity.
- Component
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- n/a through 7.0.0
- Safe version
7.0.1- Published
- Aug 13, 2026
This CVE was published Aug 13, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update to 7.0.1 or later immediately. Invalidate SSO and WordPress sessions, audit identities created or linked through Steam OpenID, and remove unauthorized accounts or role changes.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H