External risk intelligence

Headless Single Sign-On PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-28149

The vulnerability affects a Single Sign-On (SSO) plugin. SSO components are designed to be public-facing, acting as identity portals or authentication gateways that must be reachable over the internet to function in their intended capacity for users and external services.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Headless Single Sign On software, specifically related to how it handles certain data inputs. This type of issue, known as PHP Object Injection, could potentially allow an attacker to gain unauthorized control over systems that use this software for authentication. The primary concern is to confirm if our organization utilizes this specific software and, if so, to understand the potential exposure.

Unauthenticated code injection in SSO software.
Potential for unauthorized system control.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An attacker can initiate a PHP Object Injection attack against the Headless Single Sign-On plugin without needing any authentication. This is possible because the plugin is exposed to the network. By leveraging this vulnerability, an attacker could potentially execute arbitrary code, modify data, or cause denial of service.

No authentication required.
Unserialized user-controlled input.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code when supported by the advisory. This could impact the integrity and availability of the system by leading to code execution and denial of service.

System integrity and availability.
Remote code execution is possible.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this unauthenticated PHP Object Injection vulnerability, as it affects a Single Sign-On plugin that is typically internet-facing. The immediate priority is to identify all instances of the affected technology, confirm its accessibility and business criticality, and then assign an owner for remediation planning based on the assessed risk.

Application and platform teams own the issue.
Verify affected technology reachability and criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Headless Single Sign On plugin?

Headless Single Sign On is a WordPress plugin used to manage user authentication and identity verification processes. It acts as a gateway that facilitates secure access to web applications, typically by decoupling the login experience from the main site architecture to improve efficiency and user flow.

What does PHP Object Injection mean for CVE-2026-28149?

This vulnerability, classified as CWE-502, occurs when the plugin improperly handles untrusted data during the process of converting data strings back into PHP objects. Because the software does not sufficiently validate this input, an attacker can supply malicious objects that the system inadvertently executes, potentially granting unauthorized control over the server environment.

How can an attacker trigger this vulnerability?

An attacker initiates the exploit by sending specifically crafted, malicious input to the plugin that it processes without verifying the user's identity. This does not require any prior account access or administrative privileges. It will not trigger if the input is not processed through the specific vulnerable deserialization functions within the plugin's code path.

Why should I care about this vulnerability based on Halo Surface Signal?

Halo Surface Signal indicates that because this is an authentication component, it is intentionally designed to be reachable over the internet to support external users and service connections. This high level of network visibility makes it a prime target for remote attackers, significantly increasing the likelihood that the vulnerability is relevant to your external-facing infrastructure.

What are the first steps to address CVE-2026-28149?

Begin by auditing your environment to locate all active installations of the Headless Single Sign On plugin version 1.6 or earlier. Once identified, evaluate the business criticality of these instances. Immediately coordinate with your platform or application teams to prioritize these assets for remediation to mitigate the risk of unauthorized system access.

References

patchstack.com/database/wordpress/plugin/headless-single-sign-on/vul…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.