CVE-2025-9485WordPress OAuth SSO plugin JWT bypass, admin takeover
What broke
The OAuth SSO plugin for WordPress (through 6.26.12) did not verify JWT signatures correctly. An attacker could mint a token and become an administrator. Fixed in 6.26.13.
Why it matters
WordPress is not an IdP, but it is often the first SSO-enabled public site a company ships. A plugin that "adds OAuth" and then skips signature checks is how a marketing CMS becomes a privileged foothold. The same class as node-jws and SimpleHelp: the token is trusted because it looks like a token.
What to do
- Update the plugin to 6.26.13 or later. If you cannot, disable SSO on that site.
- Review WordPress administrator accounts created around the disclosure window.
- Do not point production OIDC at a plugin you have not seen verify signatures against a JWKS.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- GlossaryOAuth 2.0 Protected Resource Metadata
OAuth 2.0 Protected Resource Metadata ([RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), Proposed Standard, April 2025) is a JSON document an API publishes at
- GlossaryOAuth Client ID Metadata Document (CIMD)
An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its `client_id`, so an authoriz