Description
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.
INFO
Published Date :
2025-10-04T02:24:37.169Z
Last Modified :
2026-04-08T17:25:21.100Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2025-9485 vulnerability.
| Vendors | Products |
|---|---|
| Oauth Client Single Sign On Project |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-9485.
