Bypassing Authentication And Spoofing Arbitrary OpenID Identities

zendframework/zendopenid and magento/zendframework1 are vulnerable to bypassing authentication and spoofing arbitrary OpenID identities. The application fails to validate that openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle. This allows a malicious user to spoof arbitrary OpenID Identities by using an OpenID Identity Provider that generates OpenID tokens with arbitrary identifiers and claimed_id values.