I see sql injection vulnerabilities in this https://github.com/choppedcode/sso-whmcs/blob/master/hooks.php . Please have a check on this page to learn that your statements are vulnerables : http://www.w3schools.com/sql/sql_injection.asp

A simple apostrophe at the right place can do a lot on your code. I would suggest you to add this to your sql statements if you don't know how to make them secure : http://medoo.in/

I'm sorry for making this public, but i didn't saw any other place where i can contact the author : even on the whmcs website.

Also : this is missing a couple of validations a bit everywhere. I would highly suggest to review this code before going in production. The plugin seems to be only validating if a value exist. If it exist then you can inject.

SECURITY ISSUE
If you don't enter in your URL, the script will default to an external URL and send your credentials to that external URL.

Its been awhile since you updated this, but wondering if its still working for you with current versions of WHMCS.