CVE-2025-10294

Exploit: Authentication Bypass via Empty ownidsharedsecret JWT Forgery 1 Forge a valid JWT using an empty HMAC key root@kitploit: SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header =...

The vulnerability of the OwnID Passwordless Login plugin of the WordPress content management system allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the OwnID Passwordless Login plugin in the WordPress content management system involves bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of...

WordPress OwnID Passwordless Login plugin authentication bypass vulnerability

WordPress OwnID Passwordless Login plugin is a WordPress plugin for passwordless login function, by sending a one-time authorization code to the user's email or cell phone to complete the verification. An authentication bypass vulnerability exists in the WordPress OwnID Passwordless Login plugin,...

CVE-2025-10294

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownidsharedsecret value is empty prior to authenticating a user via JWT. This makes it possible for...

CVE-2025-10294

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownidsharedsecret value is empty prior to authenticating a user via JWT. This makes it possible for...

CVE-2025-10294 OwnID Passwordless Login <= 1.3.4 - Authentication Bypass

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownidsharedsecret value is empty prior to authenticating a user via JWT. This makes it possible for...

CVE-2025-10294

The CVE-2025-10294 entry concerns the WordPress OwnID Passwordless Login plugin. Affected versions are all up to 1.3.4, with authentication bypass caused by not properly checking if the ownid_shared_secret is empty before authenticating via JWT. This allows unauthenticated attackers to log in as ...

WordPress OwnID Passwordless Login plugin <= 1.3.4 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin OwnID Passwordless Login versions = 1.3.4...

WordPress plugin OwnID Passwordless Login 安全漏洞

WordPress OwnID Passwordless Login plugin is a WordPress plugin for passwordless login function, by sending a one-time authorization code to the user's email or cell phone to complete the verification. An authentication bypass vulnerability exists in the WordPress OwnID Passwordless Login plugin,...

CVE-2025-10294: Authentication Bypass Using an Alternate Path or Channel

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownidsharedsecret value is empty prior to authenticating a user via JWT. This makes it possible for...

PT-2025-42291

Name of the Vulnerable Software and Affected Versions OwnID Passwordless Login plugin for WordPress versions prior to 1.3.5 Description The OwnID Passwordless Login plugin for WordPress is susceptible to an Authentication Bypass. This occurs because the plugin does not adequately verify if the...