CVE-2026-28149

CriticalCVSS 9.8

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.

Risk Assessment

Risk includes arbitrary code execution on the server, potentially leading to full system compromise.

Recommendation

Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious activities.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.