Threats tagged 'ghsa-72vv-ff63-gjjc'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Critical	9.1	CVE-2026-122220WPO365 \| LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay Critical9.12026-11-04GCVE DatabaseCVE-2026-122220 The WPO365 \| LOGIN (wpo365-login) plugin before version 45.2 has an authentication bypass vulnerability due to a capture-replay flaw. This occurs because the anti-replay check in the Saml2_Service::check_message_id() function does not persist processed SAML message IDs, allowing attackers to reuse a valid SAMLResponse multiple times within its validity window to log in as the victim, including administrators. Report on CVE-2026-122220 Vulnerability CWE-294 #ghsa-72vv-ff63-gjjc	GCVE Database	2026-11-04

Page 1 of 1