CVE-2026-62108

Name of the Vulnerable Software and Affected Versions Headless Single Sign On versions prior to 1.7.1

Description An account takeover issue exists due to a flawed account-matching condition. The system incorrectly uses the username exists($userName) function regardless of the configured matcher, which allows an identity provider (IdP) asserted username to match any existing WordPress account unconditionally. This enables unauthenticated attackers to log in as any existing user, including administrators, by asserting a matching username in a crafted SAML response.

Recommendations Update to a version newer than 1.7.0.