-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete signature validation in the verify method. The patch adds 1) a check for association between op_endpoint and assoc_handle, and 2) validation that all parameters in _signParams array (and claimed_id/identity when present) are included in the signed parameters. The pre-patch version lacked these checks, enabling the described authentication bypass. The function's role in processing OpenID responses and the specific security-focused changes in the commit confirm this as the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendopenid | composer | >= 2.0.0, < 2.0.2 | 2.0.2 |