Miniorange OAuth Single Sign On – SSO OAuth Client vulnerabilities

2 CVEs affecting Miniorange OAuth Single Sign On – SSO OAuth Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97274, published 2026-09-30.

More from Miniorange.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-28008, published 2026-08-13. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
• CVE-2026-97274, published 2026-09-30. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.