CVE-2026-82843
Received Received - Intake

WP OAuth Server Identity Assertion Misuse Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-82843
EUVD
EUVD-2026-85030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_oauth_server wp_oauth_server to 6.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP OAuth Server plugin versions before 6.4.0. It allows users with Subscriber role or higher to take over another user's account by exploiting a flaw in the OpenID Connect (OIDC) identity assertion process. The plugin does not properly link the issued identity assertion to the specific authorization grant, instead returning the assertion of the most recently authenticated user.

Detection Guidance

Check the installed version of the WP OAuth Server plugin. If it is below 6.4.0, the system is vulnerable. Use WordPress admin dashboard or run a command like 'wp plugin list' in the WordPress directory to verify the plugin version.

Impact Analysis

Attackers can obtain a validly signed identity assertion for another user, including administrators, and authenticate as that user in any application using the site for single sign-on. This can lead to unauthorized access to sensitive data and actions.

Mitigation Strategies

Update the WP OAuth Server plugin to version 6.4.0 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review user roles and access permissions to ensure least privilege principles are followed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart