CVE-2026-19714 Simple JWT Login CVE debrief

Who should care

Site administrators using the Simple JWT Login WordPress plugin, especially those with Google sign-in enabled, should be aware of this critical vulnerability. Immediate action is required to prevent potential exploitation.

Technical summary

The Simple JWT Login WordPress plugin before version 3.6.8 does not properly validate the audience claim of Google identity tokens used for authentication. This oversight allows an attacker to authenticate as any user whose email address is present in a valid token, including administrators. The plugin's failure to validate the audience claim effectively bypasses authentication mechanisms, granting unauthorized access to sensitive areas of the site. This vulnerability is particularly severe because it requires no prior authentication or authorization, and it can be exploited by unauthenticated users.

Defensive priority

Immediate attention is required due to the critical severity of this vulnerability, which allows unauthenticated users to authenticate as any user, including administrators.

Recommended defensive actions

• Update the Simple JWT Login WordPress plugin to version 3.6.8 or later
• Disable Google sign-in on affected sites until the update can be applied
• Monitor authentication logs for suspicious activity
• Consider implementing additional security measures, such as two-factor authentication
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in the Simple JWT Login WordPress plugin before version 3.6.8. The plugin fails to validate the audience of Google identity tokens, which could allow attackers to authenticate as any user whose email address is contained in a token. This issue affects sites with Google sign-in enabled. Further investigation is needed to determine the full scope of affected systems and to verify vendor remediation efforts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.