The 9.8 CVSS combined with 0.00404 EPSS on this OAuth SSO authentication bypass presents a triage paradox: maximum severity with apparently minimal exploitation probability. Neither metric should be ignored, and the gap between them warrants investigation rather than passive acceptance of either.
The 'unauthenticated broken authentication' classification is technically accurate but semantically misleading in an OAuth context. This does not mean 'no authentication happens' — it typically means the wrong entity gets authenticated, or authentication can be bypassed through configuration errors the library permits but doesn't prevent. Common failure modes include state parameter bypasses, redirect URI validation failures, and token validation oversights. If your deployment uses a non-default OAuth provider configuration, the 'unauthenticated' label may not apply to your environment at all — exploitation could require specific conditions that CVSS base metrics don't capture. Treat the 9.8 as describing what would happen if exploited, not necessarily how likely exploitation is in your environment.
The low EPSS likely reflects exploitation friction rather than low impact. OAuth client plugins are authentication chokepoints — a successful exploit doesn't compromise one function, it grants access to every downstream system trusting that auth layer. The provider-specific knowledge required to exploit this class of vulnerability (understanding redirect URIs, state handling, token validation sequences) creates the cognitive barrier that keeps EPSS low. But this friction doesn't reduce blast radius if exploitation occurs.
The '<= 7.0.0' version ceiling is concerning because the patch likely shipped as a feature release without a security advisory. Organizations on auto-update may be protected, but those holding back versions have no CVE or changelog signal prompting action. This detection gap is systemic in the plugin ecosystem, not incidental. You should verify your installed version regardless of whether a security advisory exists, and audit whether your OAuth configuration matches your threat model — 'unauthenticated access' in OAuth often means access to the wrong user account under specific conditions rather than universal bypass.