{"id":"CVE-2022-2133","state":"PUBLISHED","title":"OAuth Single Sign On < 6.22.6 - Authentication Bypass","description":"The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.","publishedAt":"2022-07-17T10:36:17.000Z","updatedAt":"2024-08-03T00:24:44.224Z","severity":null,"assigner":"WPScan","products":["Unknown OAuth Single Sign On – SSO (OAuth Client)"],"affected":[{"vendor":"Unknown","product":"OAuth Single Sign On – SSO (OAuth Client)","versions":[{"version":"6.22.6","status":"affected","lessThan":"6.22.6","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T19:50:01.354Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/2xxx/CVE-2022-2133.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-2133","state":"PUBLISHED","datePublished":"2022-07-17T10:36:17.000Z","dateUpdated":"2024-08-03T00:24:44.224Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-06-20T00:00:00.000Z"},"containers":{"cna":{"title":"OAuth Single Sign On < 6.22.6 - Authentication Bypass","descriptions":[{"lang":"en","value":"The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address."}],"affected":[{"vendor":"Unknown","product":"OAuth Single Sign On – SSO (OAuth Client)","versions":[{"version":"6.22.6","status":"affected","lessThan":"6.22.6","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-07-17T10:36:17.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Lana Codes"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2022-2133","STATE":"PUBLIC","TITLE":"OAuth Single Sign On < 6.22.6 - Authentication Bypass"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"OAuth Single Sign On – SSO (OAuth Client)","version":{"version_data":[{"version_affected":"<","version_name":"6.22.6","version_value":"6.22.6"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Lana Codes"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address."}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-287 Improper Authentication"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de","refsource":"MISC","url":"https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T00:24:44.224Z"}}]}}}