CVE-2026-122220 in wpo365-login Plugin
Summary
by MITRE • 11/04/2026
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in WPO365 LOGIN plugin versions prior to 45.2 represents a critical authentication bypass mechanism rooted in flawed session management and cryptographic validation logic within its SAML integration. The core technical flaw resides specifically within the Saml2_Service::check_message_id() function, which is responsible for ensuring that each Security Assertion Markup Language message received by the application is unique and has not been previously processed. This check is a fundamental component of preventing replay attacks in identity federation protocols like SAML 2.0. However, due to a logic error in the code structure, the function returns prematurely before it can persist the identifier of the successfully validated SAML message into the transient storage array designated as wpo365_saml_message_ids. This failure means that while the system may acknowledge the validity of a signed assertion, it fails to record that this specific ID has already been consumed by the authentication service.
From an operational perspective, this defect allows attackers who possess the capability to intercept network traffic between a user's browser and the identity provider or application server to capture validly-signed SAMLResponse packets. Because the system does not maintain state regarding which message IDs have been processed, these captured responses can be replayed against the Assertion Consumer Service endpoint multiple times within the validity window of the original assertion. The attacker does not need to decrypt or forge signatures; they simply reuse the existing cryptographic proof of authentication provided by a legitimate user. This capability effectively neutralizes one of the primary security controls designed to protect SAML-based single sign-on implementations, allowing unauthorized access without triggering duplicate message detection mechanisms that would normally flag such activity as suspicious or invalid.
The impact of this vulnerability is severe, particularly given the administrative privileges often associated with enterprise collaboration tools like Microsoft 365 accessed through WPO365. An attacker can exploit this flaw to log in as any victim user whose credentials have been captured during a legitimate authentication flow, including high-privilege administrators. This leads directly to unauthorized access to sensitive corporate data, potential lateral movement within the network if administrative accounts are compromised, and complete erosion of trust in the identity provider's assertions. The lack of detection mechanisms means that these attacks can occur repeatedly without alerting security monitoring systems or triggering account lockout policies based on duplicate login attempts from different contexts, as the system perceives each replayed message as a fresh, valid authentication request.
This vulnerability aligns with CWE-294, which describes Authentication Bypass by Capture-replay, and maps to MITRE ATT&CK technique T1078, specifically Valid Accounts used for initial access or persistence. To mitigate this risk, organizations must immediately upgrade the WPO365 LOGIN plugin to version 45.2 or later where the logic error in Saml2_Service::check_message_id() has been corrected to ensure proper persistence of processed message IDs. In addition to patching, administrators should enforce strict time synchronization between all SAML participants to minimize assertion validity windows and consider implementing additional network-level protections such as TLS session binding or rate limiting on authentication endpoints to reduce the effectiveness of replay attempts even if the application-layer check is bypassed. Regular auditing of access logs for unusual patterns of successful authentications from varying IP addresses can also help in detecting potential exploitation activities that may have occurred prior to remediation.