by Kastro
Paper/Archive/CVE-2026-82843

CVE-2026-82843

Unknown WP OAuth Server ( Login with WordPress ) — WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

EPSS 0.2%CVSS 9.0
critical.is priorityof 100
29
CVSS 9.0 (ADP)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 8.5.085 × 201.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.

Affected

ProductAffectedFixed inSource
WP OAuth Server ( Login with WordPress )< 6.4.06.4.0CNA

Scores by source

CISA ADP9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploitwpscan.com/vulnerability/45bc7096-5d04-4fe6-a332-31aed507a3a0