PT-2025-5899 · Nextend · Nextend Social Login Pro

István Márton

·

Published

2025-02-07

·

Updated

2025-02-12

·

CVE-2025-1061

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Nextend Social Login Pro versions up to, and including, 3.1.16
Description The issue is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Recommendations For Nextend Social Login Pro versions up to, and including, 3.1.16, consider disabling the Apple OAuth authentication feature until a patch is available to prevent unauthenticated attackers from logging in as existing users. Restrict access to sensitive areas of the site to minimize the risk of exploitation. Avoid using the email address as a means of verification for user authentication in the affected plugin until the issue is resolved.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-1061

Affected Products

Nextend Social Login Pro