Skip to content

1.0.5 security hotfix

Choose a tag to compare

View all tags
@cjscrofani cjscrofani released this 24 Oct 00:03
· 46 commits to main since this release
v1.0.5
9377194

Security hotfix for every 1.0.x install. No settings changes; update and carry on. Tested up to: 6.8

  • Primary login mode could be bypassed by adding ?cfzt_callback=1 to the login URL, which left WordPress password login fully working. Passwords now never grant access in primary mode, and the lost-password, reset and registration screens are refused server-side.
  • The OIDC state was shared by every visitor (a nonce for user 0), allowing login CSRF and breaking concurrent logins. Each login now mints a random state bound to the browser with a short-lived HttpOnly cookie.
  • Every password login in secondary mode was rejected with "Please enter both username and backup code".
  • redirect_to now survives the Cloudflare round trip.

2.0.0 follows with automatic provisioning of the Access application and removal of the unverified SAML path.

Assets 3
Loading