Headless Single Sign On vulnerabilities

Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. The description does not provide technical details of the exploitation mechanism.

Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.

Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.