Critical severity9.8NVD Advisory· Published Jul 10, 2026· Updated Jul 21, 2026

CVE-2026-57807

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation.

This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.

Affected products

MiniOrange Security Software Pvt Ltd./OAuth Single Sign On - SSO (OAuth Client)llm-fuzzy
Range: <=38.5.8
WordPress/miniorange-oauth-oidc-single-sign-onllm-create
Range: <=38.5.8

Patches

Vulnerability mechanics

References

patchstack.com/database/wordpress/plugin/miniorange-oauth-oidc-single-sign-on/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-38-5-8-broken-authentication-vulnerabilitynvd

News mentions

⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
The Hacker News · Aug 3, 2026

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000