CVE-2026-28148

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - audit@patchstack.com

Published

2026-08-13

Last modified

2026-10-23

Weaknesses

CWE-347

Affected products

• Headless Single Sign On (Miniorange)

References

• https://patchstack.com/database/wordpress/plugin/headless-single-sign-on/vulnerability/wordpress-headless-single-sign-o…