Loading vulnerability…
Authentication Bypass in miniOrange OAuth Single Sign On – SSO (OAuth Client) for WordPress
CVE-2025-9485 is a critical authentication bypass vulnerability in the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress affecting versions up to and including 6.26.12. The flaw is caused by improper verification of JWT cryptographic signatures in the get_resource_owner_from_id_token function. The plugin processes JWT tokens received from OAuth or OpenID Connect identity providers without properly validating their signatures, allowing forged tokens to be accepted as authentic. By crafting a malicious JWT and manipulating claims such as sub, an unauthenticated attacker can impersonate arbitrary users. The issue affects deployments using the plugin’s OAuth/OpenID Connect login flows.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated remote attackers to bypass authentication and log in as any existing WordPress user represented by a forged token. This can include administrator accounts in certain configurations, resulting in full administrative access to the affected WordPress site. In some configurations, attackers can also create arbitrary subscriber-level accounts. The practical impact includes unauthorized access, privilege escalation, site takeover, and compromise of confidentiality and integrity of site content and administrative functions.
If you can’t patch tonight, do this now.
Until patching is completed, disable the plugin’s OAuth/OpenID Connect login flows or disable the plugin entirely to prevent exploitation. Restrict access to federated login endpoints where operationally feasible, and closely monitor authentication logs for anomalous logins, especially unexpected administrator sessions or newly created subscriber accounts. Because the flaw is unauthenticated and network-reachable, mitigation short of patching should be treated as temporary only.
Patch, then assume compromise.
Update the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin to version 6.26.13 or later, which is reported to patch the unsafe JWT token processing issue. Review the plugin’s OAuth/OpenID Connect authentication configuration to ensure ID tokens and related JWTs are cryptographically validated before trust decisions are made. If the plugin is not required, remove or disable it.
No valid public exploits. Mallory filtered out 2 candidates as fakes, detection scripts, or README-only repos.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.