miniOrange OAuth Single Sign On – SSO: authentication bypass (CVE-2022-34155)
An improper authentication vulnerability (CVE-2022-34155) has been described in the miniOrange OAuth Single Sign On – SSO (OAuth Client) WordPress plugin. It allows authentication bypass. CVSS score: 8.8.
Checked in Shield: no
Who is affected
Installations of the plugin up to and including version 6.23.3. Further exploitation conditions are not disclosed in the source.
How to check
In the WordPress admin, open the Plugins page and find OAuth Single Sign On – SSO (OAuth Client). If the version is 6.23.3 or lower, the site is in the affected range.
How to fix
The source does not state a fixed version. Check whether a version newer than 6.23.3 is available and update. If there is no update, consider deactivating the plugin for now.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Not disclosed yet: the fixed version and any exploitation in the wild. Source: NVD.
