Threats tagged 'ghsa-4gj8-74r8-r547'

The JWT Auth WordPress plugin versions through 3.0.2 have a vulnerability where previously issued refresh tokens are not invalidated when a user changes or resets their password or removes a connected device. This allows an attacker who obtained a refresh token before such an event to continue issuing valid access tokens and maintain authenticated access to the affected account, including accounts with Administrator privileges.