Critical

Authentication Bypass in miniOrange OAuth Single Sign On – SSO (OAuth Client) for WordPress

IdentifiersCVE-2025-9485CWE-347· Improper Verification of…

CVE-2025-9485 is a critical authentication bypass vulnerability in the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress affecting versions up to and including 6.26.12. The flaw is caused by improper verification of JWT cryptographic signatures in the get_resource_owner_from_id_token function. The plugin processes JWT tokens received from OAuth or OpenID Connect identity providers without properly validating their signatures, allowing forged tokens to be accepted as authentic. By crafting a malicious JWT and manipulating claims such as sub, an unauthenticated attacker can impersonate arbitrary users. The issue affects deployments using the plugin’s OAuth/OpenID Connect login flows.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated remote attackers to bypass authentication and log in as any existing WordPress user represented by a forged token. This can include administrator accounts in certain configurations, resulting in full administrative access to the affected WordPress site. In some configurations, attackers can also create arbitrary subscriber-level accounts. The practical impact includes unauthorized access, privilege escalation, site takeover, and compromise of confidentiality and integrity of site content and administrative functions.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, disable the plugin’s OAuth/OpenID Connect login flows or disable the plugin entirely to prevent exploitation. Restrict access to federated login endpoints where operationally feasible, and closely monitor authentication logs for anomalous logins, especially unexpected administrator sessions or newly created subscriber accounts. Because the flaw is unauthenticated and network-reachable, mitigation short of patching should be treated as temporary only.

Remediation

Patch, then assume compromise.

Update the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin to version 6.26.13 or later, which is reported to patch the unsafe JWT token processing issue. Review the plugin’s OAuth/OpenID Connect authentication configuration to ensure ID tokens and related JWTs are cryptographically validated before trust decisions are made. If the plugin is not required, remove or disable it.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.

VALID 0 / 2 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cvefeed high severityNews

Oct 4, 2025

CVE-2025-9485 - OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

A critical authentication bypass vulnerability in the WordPress OAuth Single Sign On – SSO (OAuth Client) plugin caused by unsafe JWT token processing and improper signature verification in get_resource_owner_from_id_token().

zeropath blogNews

Oct 3, 2025

OAuth SSO WordPress Plugin CVE-2025-9485: Brief Summary of Critical JWT Signature Verification Bypass - ZeroPath Blog | ZeroPath

Authentication bypass / privilege escalation vulnerability in the miniOrange OAuth Single Sign On – SSO (OAuth Client) WordPress plugin caused by missing JWT signature verification, allowing forged tokens to impersonate arbitrary users including administrators.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2