Zend Framework < 1.12.4 Multiple Vulnerabilities

Versions of Zend Framework earlier than 1.12.4 are vulnerable to the following security flaws :

• A flaw exists in the ‘Consumer’ component, as it is possible to login using an arbitrary OpenID account without knowing any secret information. With a specially crafted OpenID Provider, a remote attacker can impersonate any OpenID Identity to bypass the authentication mechanism. (CVE-2014-2684)
• A flaw in the ‘Consumer’ component, as elements in OpenID tokens are not properly checked to ensure they’re signed. The framework considers a single signed element as sufficient whereas the specification states that more elements are required to be signed if present. This may allow a remote attacker to cause insufficiently signed OpenID tokens to be accepted as valid. (CVE-2014-2685)