Vulnerabilities CVE-2026-19714

CVE-2026-19714

None

Open

TLP:CLEAR

Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

Details

Confidence: 90%
Published: Aug 16, 2026
Last Modified: Aug 16, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.