CVE-2022-2133 OAuth Single Sign On < 6.22.6 - Authentication Bypass

2022-07-1710:36:17

CWE-287

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

40.2%

JSON

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn’t validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user’s email address.

CNA Affected

[
  {
    "product": "OAuth Single Sign On – SSO (OAuth Client)",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "6.22.6",
        "status": "affected",
        "version": "6.22.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de

0.001 Low

EPSS

Percentile

40.2%

JSON

Related for CVELIST:CVE-2022-2133