CVE-2026-82183 Overview
CVE-2026-82183 is an authentication bypass vulnerability in the OAuth Single Sign On WordPress plugin before version 7.0.1. The plugin fails to verify the identity assertion returned by its Steam single sign-on (SSO) flow. Unauthenticated attackers can log in as arbitrary non-administrator users and create new accounts on affected WordPress sites. The flaw is classified under [CWE-287] Improper Authentication.
Critical Impact
Remote unauthenticated attackers can impersonate existing non-administrator users and create attacker-controlled accounts by manipulating the Steam SSO identity assertion.
Affected Products
- OAuth Single Sign On WordPress plugin versions prior to 7.0.1
- WordPress installations using the plugin's Steam SSO login flow
- Any site exposing the plugin's Steam authentication endpoint to the internet
Discovery Timeline
- 2026-09-02 - CVE-2026-82183 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-82183
Vulnerability Analysis
The OAuth Single Sign On plugin integrates Steam as an identity provider through the OpenID-based Steam login flow. When a user completes the Steam login redirect, Steam returns an identity assertion that the relying party must validate against Steam's OpenID endpoint. The plugin does not perform this verification. It accepts the returned assertion as authoritative and provisions a WordPress session for the claimed Steam identity.
Because the assertion is trusted without cryptographic validation, an attacker can forge or replay the parameters passed back to the WordPress callback. The attacker controls the Steam identifier bound to the WordPress account and therefore controls which user is authenticated. The plugin also creates new WordPress accounts when the Steam identifier is unknown, expanding the impact beyond impersonation into arbitrary account creation.
The scope is limited to non-administrator accounts, but authenticated subscriber, author, editor, or contributor access is sufficient to reach further plugin and post-authentication attack surface.
Root Cause
The root cause is missing verification of the OpenID openid.mode=id_res response from Steam. A correct implementation must re-post the response parameters to https://steamcommunity.com/openid/login with openid.mode=check_authentication and confirm the response contains is_valid:true. The vulnerable plugin skips this check and trusts client-supplied parameters. This maps to [CWE-287] Improper Authentication.
Attack Vector
Exploitation is network-based and requires no privileges or user interaction on the target site. An attacker crafts an HTTP request to the plugin's Steam SSO callback with attacker-chosen OpenID response parameters, including a claimed_id corresponding to a targeted user or a new account. The plugin issues a valid WordPress session cookie in response. The Network attack vector combined with High attack complexity reflects the need to shape the callback correctly against the vulnerable flow.
Refer to the WPScan Vulnerability Report for the technical write-up.
Detection Methods for CVE-2026-82183
Indicators of Compromise
- Unexpected new WordPress user accounts created with Steam-linked metadata or steam_ username prefixes.
- Successful logins in wp-login or plugin audit logs that lack a corresponding browser-initiated Steam redirect flow.
- HTTP requests to the plugin's Steam callback endpoint containing openid.mode=id_res parameters from unusual source IP addresses.
- User role changes or content modifications by non-administrator accounts that predate the compromise.
Detection Strategies
- Inventory WordPress sites and identify installations of the OAuth Single Sign On plugin with a version earlier than 7.0.1.
- Correlate Steam SSO callback requests against outbound verification calls to steamcommunity.com/openid/login; absence of the verification call indicates the vulnerable path.
- Alert on account creation events originating from the Steam SSO handler within short time windows from single source IPs.
Monitoring Recommendations
- Forward WordPress authentication and user-creation events into a centralized logging platform for correlation.
- Monitor web server access logs for POST or GET requests to the plugin's Steam callback URL with anomalous openid.* parameter patterns.
- Track sudden increases in low-privilege user sessions accessing wp-admin endpoints such as profile.php and admin-ajax.php.
How to Mitigate CVE-2026-82183
Immediate Actions Required
- Update the OAuth Single Sign On WordPress plugin to version 7.0.1 or later on all affected sites.
- Audit the WordPress users table for accounts created through the Steam SSO flow since the plugin was installed and disable or remove unauthorized entries.
- Force a password reset and session invalidation for all non-administrator accounts that could have been impersonated.
- Review post, comment, and plugin configuration changes made by non-administrator accounts during the exposure window.
Patch Information
The vendor addressed the flaw in OAuth Single Sign On version 7.0.1 by adding server-side verification of the Steam OpenID identity assertion. See the WPScan Vulnerability Report for advisory details and fixed-version confirmation.
Workarounds
- Disable the Steam SSO provider in the plugin configuration until the site can be upgraded to 7.0.1.
- Deactivate the OAuth Single Sign On plugin entirely on sites that do not require third-party login.
- Restrict access to the plugin's Steam callback endpoint using a web application firewall rule that blocks unauthenticated requests carrying openid.mode=id_res parameters.
- Enforce administrator-only registration in WordPress general settings to reduce the impact of arbitrary account creation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
