CVE-2026-28149

The vulnerability allows unauthenticated PHP Object Injection in Headless Single Sign On versions up to 1.6, potentially enabling attackers to execute arbitrary code on the server. This critical flaw poses a significant risk to any organization using affected versions, as it can lead to complete system compromise. Organizations utilizing Headless Single Sign On should prioritize immediate patching or mitigation efforts to safeguard their systems.