OAuth Single Sign On < 6.26.13 - Authentication Bypass

Description

The plugin is vulnerable to Improper Verification of Cryptographic Signature due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.