What’s Vulnerable › Products

miniOrange Headless Single Sign On vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your miniOrange Headless Single Sign On version is affected

Latest miniOrange Headless Single Sign On vulnerabilities

• CVE-2026-62108 — WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability (CVSS 9.8)
• CVE-2026-28149 — WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability (CVSS 9.8)
• CVE-2026-28148 — WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability (CVSS 9.8)