CVE-2026-28148
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.
Risk Assessment
Risk includes unauthorized access to protected resources, potentially leading to data confidentiality breach.
Recommendation
Update the plugin to the latest patched version. Implement additional access control mechanisms and monitor logs for suspicious activities.
Other vulnerabilities in Headless Single Sign On
See all- CVE-2026-62108Critical
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. The description does not provide technical details of the exploitation mechanism.
- CVE-2026-28149Critical
Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.
Original NVD description (English source)
Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS