What is the CVSS score of EUVD-2026-57946?

EUVD-2026-57946 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Headless Single Sign On are affected by EUVD-2026-57946?

A critical authentication bypass in miniOrange Headless Single Sign On WordPress plugin versions 1.6 and earlier enables unauthenticated attackers to forge JWT tokens and assume administrative access…

How to fix or mitigate EUVD-2026-57946?

Within 24 hours: identify and catalog all instances of miniOrange Headless SSO plugin across WordPress deployments, noting version numbers; immediately disable the plugin or restrict network access to affected instances if immediate disabling is not operationally feasible. Within 7 days: deploy Web Application Firewall or API gateway rules to block JWT manipulation and authentication bypass attempts; enable comprehensive audit logging on authentication events and administrator account access; review access logs for indicators of unauthorized administrative access since deployment. Within 30 days: contact miniOrange for patch timeline and interim security guidance; evaluate and pilot alternative authentication plugins; execute migration to patched version once available, or plan decommissioning of this plugin if vendor cannot remediate within your acceptable risk window.

Headless Single Sign On EUVD-2026-57946

| CVE-2026-28148 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-13 Patchstack

GHSA-j2jj-77qx-hh3h

WordPress Authentication Bypass Jwt Attack Wordpress Plugin Headless Single Sign On Miniorange

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable JWT signature bypass needs no auth or interaction (AV:N/AC:L/PR:N/UI:N), and forging an admin identity yields full C/I/A compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:58 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

AnalysisAI

Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the miniOrange 'headless-single-sign-on' plugin for WordPress (CPE cpe:2.3:a:miniorange:headless_single_sign_on), which brokers authentication for headless/decoupled WordPress deployments by issuing and validating JSON Web Tokens (JWTs) for API consumers. The vulnerability is classified CWE-347, Improper Verification of Cryptographic Signature, and the 'Jwt Attack' tag indicates the flaw lies in how the plugin validates JWT signatures - for example accepting the 'none' algorithm, failing to verify the signature, or trusting attacker-controllable claims. Because JWTs in a headless SSO flow directly assert the authenticated identity, a signature-verification defect lets an attacker mint a token the plugin will accept as a legitimate session.

RemediationAI

Upgrade the Headless Single Sign On plugin to a release later than 1.6; the input data does not include an exact fixed version, so treat this as 'Patch available per vendor advisory' and confirm the specific patched build via the Patchstack listing (https://patchstack.com/database/wordpress/plugin/headless-single-sign-on/vulnerability/wordpress-headless-single-sign-on-plugin-1-6-bypass-vulnerability-vulnerability?_s_id=cve) or the miniOrange plugin changelog before deploying. If an updated version cannot be applied immediately, deactivate the Headless Single Sign On plugin to remove the vulnerable JWT validation path (side effect: headless/API-based authentication for decoupled front-ends will stop working), or restrict access to the plugin's SSO/token API endpoints at the WAF or reverse-proxy layer to trusted networks only (side effect: legitimate external headless clients may be blocked and require allowlisting). Rotate any signing secrets after patching in case tokens were forged.