CVE-2026-82183: Unknown OAuth Single Sign On

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Affected products

• Unknown OAuth Single Sign On: from 6.25.0, before 7.0.1 (fixed in 7.0.1)

Published 2026-09-02. Last modified 2026-09-03.