CVE-2026-28148

Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.

Risk includes unauthorized access to protected resources, potentially leading to data confidentiality breach.

Update the plugin to the latest patched version. Implement additional access control mechanisms and monitor logs for suspicious activities.