WordPress Descope plugin < 1.2.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Descope versions 1.2.0...

CVE-2026-110959

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...

EUVD-2026-124272

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...

CVE-2026-110959

The Descope WordPress plugin prior to version 1.2.0 is vulnerable to an unauthenticated account takeover . The root cause is the failure to validate the authentication token received before creating a WordPress session; the plugin accepts any non-empty token. An unauthenticated attacker can explo...

CVE-2026-110959 Descope < 1.2.0 - Unauthenticated Account Takeover

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...

CVE-2026-110959: Unknown Descope: The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a…

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...

PT-2026-145702

The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account'...

Critical 'nOAuth' Flaw in Microsoft Azure AD Enabled Complete Account Takeover

A security shortcoming in Microsoft Azure Active Directory AD Open Authorization OAuth process could have been exploited to achieve full account takeover, researchers said. California-based identity and access management service Descope, which discovered and reported the issue in April 2023, dubb...

Potential Risk of Privilege Escalation in Azure AD Applications

Summary Microsoft has developed mitigations for an insecure anti-pattern used in Azure AD AAD applications highlighted by Descope, and reported to Microsoft, where use of the email claim from access tokens for authorization can lead to an escalation of privilege. An attacker can falsify the email...