What is GHSA-vq3q-w9wv-xc6j?

GHSA-vq3q-w9wv-xc6j is a security advisory published by GitHub Security Advisories with Critical severity. The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google...

Which CVE IDs does GHSA-vq3q-w9wv-xc6j cover?

GHSA-vq3q-w9wv-xc6j covers the following CVE IDs: CVE-2026-19714. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vq3q-w9wv-xc6j?

GHSA-vq3q-w9wv-xc6j has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-vq3q-w9wv-xc6jCriticalCVSS 9.1

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google...

Vendor

GitHub Security Advisories

Published

August 16, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-19714 →

📋 Description

The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-19714
https://wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d
https://github.com/advisories/GHSA-vq3q-w9wv-xc6j