Simple JWT Login accepts Google tokens issued for other applications
Simple JWT Login before 3.6.8 does not validate the audience of a Google sign-in id_token. When Google sign-in is enabled, an unauthenticated attacker can submit a valid Google token issued to a different application and be authenticated as the WordPress user whose email appears in that token, including an administrator if the email matches.
- Component
- Simple JWT Login
- Plugin slug
simple-jwt-login- Affected
- < 3.6.8
- Safe version
3.6.8- Published
- Aug 16, 2026
This CVE was published Aug 16, 2026 and is one of 5 known issues for this plugin.
Update, patch or deactivate.
Update to 3.6.8 or later, invalidate WordPress and JWT sessions, review Google-sign-in activity, and audit accounts whose email addresses may have been impersonated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N