CVE-2026-82842highCWE-269

CVE-2026-82842: high-severity vulnerability in SAML Single Sign On

SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

Published

Follow this CVE+ Monitor SAML Single Sign On

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.1epss 0.4%
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · SAML Single Sign On
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SAML Single Sign On

In the same product, most dangerous first.

CVE-2026-19842HIGHSAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor OverwriteEPSS 0.3%