Vulnerability · Published Oct 4, 2025 · Assigned by Wordfence

CVE-2025-9485OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

Critical 9.8

In plain English

A critical-severity security flaw in OAuth Single Sign On – SSO (OAuth Client) from cyberlord92. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.

Affected products (as reported)

Vendor	Product	Versions
cyberlord92	OAuth Single Sign On – SSO (OAuth Client)	0 – through 6.26.12

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References