CVE-2026-82183: CWE-287 Improper Authentication in OAuth Single Sign On

CVE-2026-82183 is an improper authentication vulnerability in the OAuth Single Sign On WordPress plugin prior to version 7.0.1. The plugin fails to verify the identity assertion returned by the Steam single sign-on flow, which permits unauthenticated attackers to impersonate arbitrary non-administrator users or create new accounts without proper authorization. This vulnerability impacts authentication integrity and could lead to unauthorized access and account creation.

Successful exploitation allows unauthenticated attackers to bypass authentication controls, log in as arbitrary non-administrator users, and create new user accounts. This compromises the integrity and confidentiality of user accounts and potentially the WordPress site environment. The vulnerability does not affect administrator accounts directly but still poses a significant risk due to unauthorized access.

No official patch or remediation has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the Steam single sign-on feature or restricting its use to trusted environments if possible.