Description

Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T14:17:00.303Z",
  "pubdate": "2026-08-13T14:17:00.303Z",
  "executiveSummary": "An unauthenticated broken authentication vulnerability has been identified in the Log in with Google plugin affecting versions 1.4.2 and prior. This security flaw allows unauthenticated remote attackers to bypass standard authentication mechanisms provided by the plugin, potentially granting unauthorized access to affected systems and user accounts without requiring valid credentials. The vulnerability exposes deployed instances to severe account takeover risks, compromising the confidentiality, integrity, and availability of the underlying web application. Attackers do not require specialized privileges or prior system access to mount an exploitation attempt, relying solely on network accessibility to the vulnerable component. Given the nature of authentication plugins, successful exploitation undermines the trust boundary of the identity verification process, making remediation critical for securing user sessions and preventing unauthorized privilege escalation.",
  "technicalDetails": "The vulnerability resides within the authentication handling logic of the Log in with Google component for versions <= 1.4.2. The root cause stems from improper validation and handling of authentication assertions, tokens, or session creation workflows during the third-party OAuth/OpenID authentication sequence managed by the plugin. Specifically, the vulnerable component fails to adequately verify the authenticity of the incoming authentication response or incorrectly trusts client-supplied parameters during the login handshake.\nExploitation of this vulnerability is achievable by an unauthenticated adversary interacting directly with the network endpoints exposed by the vulnerable plugin. The attack flow generally initiates when an attacker crafts a manipulated HTTP request or forged authentication response designed to mimic a legitimate Google OAuth callback or token validation sequence. Because the vulnerable code path lacks rigorous cryptographic verification, state validation, or session integrity checks, the application incorrectly interprets the malicious payload as a valid, authenticated user session.\nThe affected component handles session generation based on easily spoofed identifiers or trusts unverified claims. Consequently, the application instantiates a valid authenticated session for an arbitrary user specified in the payload, bypassing the standard password verification and identity assertion checks. The network exposure is external, requiring only HTTP/HTTPS access to the web server hosting the vulnerable plugin. Post-exploitation impact includes full account takeover, unauthorized access to sensitive user data, and potential execution of actions with the privileges of the targeted user account, ranging from standard user roles up to administrative access depending on the targeted account context."
}