OwnID Passwordless Login WordPress Plugin Authentication Bypass Vulnerability

A vulnerability allowing authentication bypass has been identified in the OwnID Passwordless Login plugin for WordPress, affecting all versions through 1.3.4. The issue arises because the plugin fails to properly verify whether the ownid_shared_secret value is empty before authenticating users via JSON Web Tokens (JWT). This flaw enables unauthenticated attackers to log in as other users, including administrators, on WordPress instances where the plugin has not been fully configured.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to bypass authentication and log in as other users, potentially including administrators.