CVE-2025-9485

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9485", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T08:59:36.029Z", "datePublished": "2025-10-04T02:24:37.169Z", "dateUpdated": "2026-04-08T17:25:21.100Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:21.100Z"}, "affected": [{"vendor": "cyberlord92", "product": "OAuth Single Sign On \u2013 SSO (OAuth Client)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.26.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts."}], "title": "OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L577"}, {"url": "https://plugins.trac.wordpress.org/changeset/3360768/miniorange-login-with-eve-online-google-facebook"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-347 Improper Verification of Cryptographic Signature", "cweId": "CWE-347", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-08-15T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-03T14:11:31.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T14:14:07.678306Z", "id": "CVE-2025-9485", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T14:16:32.877Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-06T14:14:07.678306Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T14:14:16.651Z"}}], "cna": {"title": "OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "cyberlord92", "product": "OAuth Single Sign On \u2013 SSO (OAuth Client)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.26.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-15T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-03T14:11:31.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L577"}, {"url": "https://plugins.trac.wordpress.org/changeset/3360768/miniorange-login-with-eve-online-google-facebook"}], "descriptions": [{"lang": "en", "value": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:21.100Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9485", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:25:21.100Z", "dateReserved": "2025-08-26T08:59:36.029Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-04T02:24:37.169Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OAuth Single Sign On \u2013 SSO (OAuth Client)", "vendor": "cyberlord92", "versions": [{"lessThanOrEqual": "6.26.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts."}, {"lang": "es", "value": "El plugin OAuth Single Sign On - SSO (cliente OAuth) para WordPress es vulnerable a la Verificaci\u00f3n Incorrecta de Firma Criptogr\u00e1fica en versiones hasta la 6.26.12, inclusive. Esto se debe a que el plugin realiza un procesamiento inseguro de tokens JWT sin verificaci\u00f3n ni validaci\u00f3n en la funci\u00f3n get_resource_owner_from_id_token. Esto permite a atacantes no autenticados eludir la autenticaci\u00f3n y obtener acceso a cualquier cuenta de usuario existente -incluidos los administradores en ciertas configuraciones- o crear cuentas arbitrarias de nivel de suscriptor."}], "id": "CVE-2025-9485", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9485", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T14:14:07.678306Z", "version": "2.0.3"}}]}, "published": "2025-10-04T03:15:38.780", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L577"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3360768/miniorange-login-with-eve-online-google-facebook"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:19:52.637958+00:00", "value": {"mitigation_remediation": ["Update the OAuth Single Sign On \u2013 SSO plugin to the latest version that includes proper JWT signature verification (V6.26.13 or later).", "If an update is unavailable, disable the OAuth SSO feature in the plugin settings to prevent authentication bypass until a patch is released.", "Monitor the WordPress plugin repository and security advisories for a formal patch or CVE update and apply it promptly."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass / Account Takeover"}, "threat_synthesis": {"affected_systems": "This issue affects the OAuth Single Sign On \u2013 SSO (OAuth Client) plugin from cyberlord92 distributed through WordPress, versions up to and including 6.26.12. Users running these versions of the plugin on any WordPress installation are susceptible.", "description_and_impact": "The OAuth Single Sign On \u2013 SSO plugin for WordPress is vulnerable to improper verification of cryptographic signature, allowing unauthenticated attackers to forge JSON Web Tokens. The plugin's get_resource_owner_from_id_token() function processes ID tokens without verifying the signature, which bypasses authentication. Attackers can trigger login with a fabricated token and gain access to any existing user account, including administrators, or create new subscriber-level accounts.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity, though the EPSS score of less than 1% suggests a low probability of exploitation in the wild at present. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit this flaw remotely by crafting a malicious ID token within the OAuth authentication flow, thereby bypassing authentication without needing any credentials. This provides full account takeover for existing users or creation of new accounts."}}}}, "created": "2025-10-06T14:42:04.473285+00:00", "updated": "2026-04-20T19:30:06.159904+00:00", "vendors": ["oauth_client_single_sign_on_project", "oauth_client_single_sign_on_project$PRODUCT$oauth_client_single_sign_on", "wordpress", "wordpress$PRODUCT$wordpress"]}