CVE-2026-62108
CriticalCVSS 9.8Summary
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. The description does not provide technical details of the exploitation mechanism.
Risk Assessment
May allow an unauthenticated attacker to bypass authentication mechanisms and gain unauthorized access. Urgent verification and update are recommended.
Recommendation
Upgrade the Headless Single Sign On plugin to a version later than 1.7.0. Check with the vendor for a fix and verify your authentication configuration.
Other vulnerabilities in Headless Single Sign On
See all- CVE-2026-28149Critical
Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.
- CVE-2026-28148Critical
Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.
Original NVD description (English source)
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.