The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce r

CVE-2026-8457 影响 WooCommerce Social Login 插件（WordPress）所有版本直至 2.8.7。该插件为 WooCommerce 提供社交登录功能，其中苹果登录处理器存在严重认证绕过漏洞。漏洞根源在于插件接受苹果返回的 id_token 后，仅对 JWT 的 base64 编码载荷进行解码，完全没有验证 JWT 签名是否由苹果公钥签发，也不校验 issuer（发行方）、audience（受众）和 expiry（过期时间）等标准声明。与此同时，触发登录流程所需的安全 nonce 被插件以本地化 JavaScript 对象形式直接输出到登录页面，未认证用户即可获取。组合利用这两点，攻击者可以伪造任意 id_token，在其载荷中填入目标 WordPress 用户的电子邮件地址（例如管理员邮箱），插件会直接以该邮箱在 WordPress 用户表中查找并匹配账户，成功后立即创建已认证会话，从而以该用户身份登录。整个攻击链无需任何前置权限，也不涉及用户交互，攻击面完全对外开放。CVSS 评分为 9.8（严重），攻击向量为网络，攻击复杂度低，影响机密性、完整性和可用性。目前元数据中未标明该漏洞已列入 KEV 或存在在野利用证据，但鉴于严重性，建议立即采取缓解措施。

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean

### Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. ### Impact An attacker who could authenticate at the config

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults