CVE-2026-82843

Name of the Vulnerable Software and Affected Versions WP OAuth Server ( Login with WordPress ) versions prior to 6.4.0

Description The plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the assertion of the most recently authenticated user. This allows users with the Subscriber role or higher to obtain a signed identity assertion for another user, such as an administrator, enabling them to authenticate as that user on any application utilizing the site for single sign-on.

Recommendations Update WP OAuth Server ( Login with WordPress ) to version 6.4.0 or later.