CVE-2024-50478

🗓️ 28 Oct 2024 12:32:27Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

CVE-2024-50478 WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerabilit

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Improper Authentication in Swoopnow 1-Click_Login\:_Passwordless_Authentication	5 Nov 202422:04	–	githubexploit
Circl	CVE-2024-50478	23 Apr 202616:07	–	circl
Cvelist	CVE-2024-50478 WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability	28 Oct 202412:32	–	cvelist
NVD	CVE-2024-50478	28 Oct 202413:15	–	nvd
OSV	CVE-2024-50478	28 Oct 202413:15	–	osv
Patchstack	WordPress 1-Click Login: Passwordless Authentication Plugin 1.4.5 is vulnerable to Broken Authentication	25 Oct 202400:00	–	patchstack
Patchstack	WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability	25 Oct 202407:49	–	patchstack
Positive Technologies	PT-2024-34254 · Unknown · Swoop 1-Click Login: Passwordless Authentication	28 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-50478	5 Feb 202506:40	–	redhatcve
Vulnrichment	CVE-2024-50478 WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability	28 Oct 202412:32	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

swoopnow 1-click_login:_passwordless_authenticationMatch1.4.5wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "swoop-password-free-authentication",
    "product": "1-Click Login: Passwordless Authentication",
    "vendor": "Swoop",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/vulnerability/swoop-password-free-authentication/wordpress-1-click-login-passwordless-authentication-plugin-1-4-5-broken-authentication-vulnerability

Parameter	Position	Path	Description	CWE
token	query param	wp-json/swoop/v1/callback	Authentication bypass via callback endpoint using JWT token to impersonate another user.	CWE-305, CWE-287

17 Jun 2026 08:04Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.19.8

EPSS0.01092

SSVC