OAuth Steam SSO Identity Assertion Verification Bypass

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The OAuth Single Sign On WordPress plugin before version 7.0.1 contains a critical authentication bypass vulnerability (CWE-287: Improper Authentication) in its Steam single sign-on integration. The plugin fails to properly verify identity assertions returned from Steam's OAuth flow, enabling unauthenticated attackers to forge authentication tokens and log in as arbitrary non-administrator users or create new accounts. This affects any WordPress installation using this plugin for Steam-based authentication, potentially exposing user accounts and site functionality to unauthorized access. With a CVSS score of 8.1, this represents a high-severity risk to WordPress communities and gaming platforms that rely on Steam authentication.

Casky's 283 mapped skills detect this vulnerability pattern across two critical MITRE ATT&CK tactics: Initial Access (TA0004) and Credential Access (TA0006). Security practitioners using Casky would identify suspicious authentication flows where identity assertions lack cryptographic validation, detect account creation events from unauthenticated sources, and spot lateral movement patterns consistent with unauthorized user impersonation. Claude's extended reasoning capabilities correlate failed assertion validations with successful authentication events—the hallmark of this bypass. Practitioners would observe findings showing OAuth token reuse, missing signature verification steps, and authentication successes despite failed identity confirmation checks, enabling them to patch before exploitation and audit logs for evidence of compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82183.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-82183

Casky has 283 skills that investigate the attack patterns behind CVE-2026-82183. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn