CVE-2026-19714
Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation
- State
- Published
- Severity
- 9.1 Critical
- Published
- Aug 16, 2026
- Updated
- Aug 17, 2026
- Reserved
- Aug 13, 2026
Description
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Simple JWT LoginUnknown |
|
References
- https://wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.