Authentication bypass in miniOrange OAuth Single Sign On, SSO (OAuth Client)

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

• Product: miniOrange OAuth Single Sign On, SSO (OAuth Client), WordPress package miniorange-login-with-eve-online-google-facebook.
• Affected range: versions less than or equal to 7.0.0.
• Confirmed unaffected release: 7.0.1 is listed by the CNA and Patchstack as patched.
• Default status: unaffected outside the stated affected range. The record does not independently establish the status of every parallel or later release branch beyond the published information.

miniOrange OAuth Single Sign On, SSO (OAuth Client) contains an authentication flaw classified as CWE-290, Authentication Bypass by Spoofing. The issue is reachable over the network by an unauthenticated attacker, with no prior privileges and no user interaction required. Patchstack states that the flaw may let a malicious actor perform actions normally restricted to higher-privileged users and may allow administrative access to the website. The record does not identify the affected endpoint, OAuth callback, token, input parameter, or validation logic. The exact exploit sequence and attacker-controlled input therefore remain undisclosed in the available evidence.

• Reachability: network.
• Authentication: not required.
• Required privileges: none.
• User interaction: none.
• Complexity: low according to the supplied attack properties.
• CISA enrichment records exploitation as none, and the supplied record marks public_exploit as false. These statuses describe the available evidence and do not prove that exploitation is impossible or that an undisclosed exploit does not exist.

The flaw may allow a remote unauthenticated attacker to bypass authentication or spoof an authenticated identity within the plugin's scope. The technical outcome may include execution of higher-privileged actions and potentially administrative access to the website. From that level of access, website data, configuration, and availability could be affected, but the record does not specify the exact permitted actions or the privilege boundary after authentication is bypassed. The record contains no evidence that a compromise has occurred.

• An unauthenticated attacker may be able to perform actions normally reserved for authenticated or higher-privileged users.
• If administrative access is obtained, a website could face unauthorized changes to configuration, content, accounts, or data; the exact actions depend on what the flaw permits.
• Possible consequences include data disclosure, data modification, and WordPress service disruption, consistent with the recorded impact scope.
• The record does not confirm a breach, campaign, victim, or specific malicious action.

1. Update the miniOrange OAuth Single Sign On, SSO (OAuth Client) plugin to 7.0.1, which the CNA and Patchstack identify as patched.
2. The CNA solution recommends the latest available release with a version of at least 7.0.1; verify the actual installed release on every website and deployment branch.
3. If an immediate update is not possible, use the mitigation mechanism reported by Patchstack to block related requests while the update is pending. The available evidence does not provide its deployment details or coverage boundaries.
4. After updating or applying mitigation, review administrator accounts, privilege changes, OAuth configuration, and privileged activity for signs of abuse. Do not treat mitigation as a permanent substitute for updating.

1. Inventory WordPress websites running the miniOrange OAuth Single Sign On, SSO (OAuth Client) plugin, including low-traffic and separately managed installations.
2. Identify package miniorange-login-with-eve-online-google-facebook and compare the installed version with the affected range in affected_summary.
3. Review for unexpected administrator accounts, privilege changes, logins, or privileged actions associated with OAuth or SSO activity. This is precautionary monitoring, not a CNA-confirmed indicator.
4. Review available web and WordPress logs for unusual authentication requests, OAuth callbacks, or administrative actions.
5. No specific endpoint, log event, IOC, or payload is provided. Absence of suspicious log evidence does not prove that an installation is safe.