What’s Vulnerable › Vulnerabilities

CVE-2022-2133: OAuth Single Sign On < 6.22.6 - Authentication Bypass

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-17 · updated 2026-06-17
• Weakness: CWE-287

Description

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

Affected products

• miniOrange OAuth Single Sign On – SSO (OAuth Client): before 6.22.6 — fixed in 6.22.6

How to fix

Upgrade to a fixed version: miniOrange OAuth Single Sign On – SSO (OAuth Client) 6.22.6. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de
• https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de

Get alerted when CVE-2022-2133 or the next vulnerability affects your stack