CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
Explanation of Vulnerability in Simple Terms
The OAuth Single Sign On plugin for miniOrange contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full control over the site. The flaw stems from improper validation of OAuth tokens, enabling attackers to forge authentication credentials without valid user interaction. This affects all versions up to 38.5.8. Site administrators should update immediately to a patched version.
What an attacker can do
Bypass authentication and gain full administrative access to the site without valid credentials.
Potential impact on your site
Complete compromise of site security; attacker can read, modify, or delete all data and user accounts.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
