CVE Catalog
CVE-2026-28149
CriticalCVSS 9.8Summary
Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.
Risk Assessment
Risk includes arbitrary code execution on the server, potentially leading to full system compromise.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious activities.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.