Authentication Bypass in miniOrange OAuth Single Sign On - SSO (OAuth Client)

Successful exploitation can allow an unauthenticated remote attacker to bypass authentication through the password recovery mechanism or a related alternate access path. The published CVSS vector indicates high impact to confidentiality, integrity, and availability, which is consistent with potential unauthorized account access and subsequent full compromise of the affected WordPress site or its application context, depending on the privileges obtained.

Until a fixed version can be deployed, restrict or disable exposed password recovery functionality associated with the affected plugin where operationally feasible. Limit public access to administrative and authentication-related endpoints, enforce strong monitoring of account recovery and login events, and apply compensating controls such as web application firewall rules, IP-based access restrictions, and additional authentication safeguards. Administrators should also monitor for suspicious password reset activity and review privileged accounts for unauthorized access.

Update the miniOrange OAuth Single Sign On - SSO (OAuth Client) plugin to a fixed version newer than 38.5.8 once an official vendor patch is available. If a patched release has already been published, upgrade immediately to that version or later. Review vendor security guidance for any additional post-upgrade steps, including validating authentication and password recovery workflows and auditing for unauthorized account changes.