# Security implications of exposed SSO Secret in multi-user install?

**URL:** <https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092>\
**Category:** WordPress\
**Created:** [5월 21, 2015, 8:39오후 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092 "2015-05-21T20:39:00Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\
**Post date:** [5월 22, 2015, 4:47오전 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092/5 "2015-05-22T04:47:00Z")

</div>

> [@jetatomic](#):
>
> What are the risks with the sso secret being available to the subsite admins?

Basically, they will be able to forge SSO packets and therefore log into the forum as any user, including admins or a brand-new admin.

---

_[View the full topic](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092)._