Skip to content
Critical Vulnerabilities in OAuth/SAML Authentication Expose Multiple Vendors

Critical Vulnerabilities in OAuth/SAML Authentication Expose Multiple Vendors

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:20 UTC
  • •Eight critical authentication bypass vulnerabilities reported in three weeks.
  • •CVE-2026-75800 allows unauthenticated admin takeover in Frontegg plugin.
  • •78% of OAuth/SAML implementations lack proper assertion binding validation.

Between September 26 and October 17, 2026, eight critical authentication bypass vulnerabilities were reported across various vendors, including Frontegg and Citrix. The most severe, CVE-2026-75800, allows unauthenticated admin takeover in the Frontegg SAML SSO plugin for WordPress, with a CVSS score of 9.8. Other notable vulnerabilities include CVE-2026-110862 and CVE-2026-107406, both rated 9.3 and 9.5 respectively, affecting OAuth and SAML implementations. These flaws stem from a systemic failure to validate identity assertions against local security contexts, leading to significant risks of unauthorized access. The Cloud Security Alliance reports that 78% of OAuth and SAML implementations lack proper assertion binding validation. As of now, no patches have been released for the Frontegg vulnerability, and administrators are advised to remove the affected plugin immediately. The overall trend indicates a growing complexity in the attack surface as organizations increasingly integrate middleware and agent workflows.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-17
CVE-2026-15943 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-24
CVE-2026-76835 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-12
CVE-2026-75800 published
Critical vulnerability in Frontegg SAML SSO plugin allows unauthenticated admin takeover.
Forkast.News
2026-09-26
CVE-2026-100684 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-08
CVE-2026-107406 published
Citrix SAML patch issues reported, with emergency fixes failing to address the vulnerability.
Forkast.News
2026-10-13
CVE-2026-108131 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-96222 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CVE-2026-110862 published
Better Auth OAuth state reuse vulnerability disclosed, highlighting framework-level failures.
Forkast.News

More articles in this cluster (2)

Following this threat?

Track CVE-2026-100684 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4

Common questions

What systems are affected by CVE-2026-75800?
The vulnerability affects all versions of the Frontegg SAML SSO plugin for WordPress up to and including 1.0.1.
Is there a patch available for these vulnerabilities?
As of now, no fixed version of the Frontegg plugin has been released, and administrators are advised to remove it.
What immediate actions should administrators take?
Administrators should remove the vulnerable Frontegg plugin and audit their user database for unauthorized accounts.