CVE-2026-28149
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.
Risk Assessment
Risk includes arbitrary code execution on the server, potentially leading to full system compromise.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious activities.
Other vulnerabilities in Headless Single Sign On
See all- CVE-2026-62108Critical
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. The description does not provide technical details of the exploitation mechanism.
- CVE-2026-28148Critical
Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS