CVE-2026-28149

Name of the Vulnerable Software and Affected Versions Headless Single Sign On versions prior to 1.7

Description An issue exists where unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, allowing an attacker to manipulate the resulting object. While no POP chain is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update Headless Single Sign On to a version newer than 1.6.