Plugin has been closed? about simple-jwt-login

[nicumicle]

Simple JWT Login is running through a security audit and it has been temporarily closed due to some vulnerabilities in the JWT library that we use.

I'm working to fix this issue and by the end of the week, I will send the plugin to be reviewed.
After I send it to review, we will have to wait to be reapproved.

Hopefully, in a couple of days, the plugin will be live on WordPress.org.

Meanwhile, you can download the plugin from GitHub. I will also include a download link on the https://simplejwtlogin.com website.

I will come back with updates.

[nicumicle]

It is just a vulnerability in the library. The plugin is not affected by this.

The vulnerability refers to when decoding the JWT with multiple keys(array of keys), and the user changes the algorithm in the JWT header.
The simple-jwt-login plugin allows only one algorithm to be specified, and only one "decryption key".
So in simple words,your sites are safe. The plugin code never enters that part of the code in the library.

[nicumicle]

PS: Thanks @Weeb for the heads up!!

[dani3l3]

Are our sites vulnerable to a specific attack, at this moment, or is it just "a" vulnerability in the library that can't be directly exploited? Do you know/have insights to share about the issue?
Thanks,

[dani3l3]

Thank you, sir!

[nicumicle]

The plugin is now open. Version 3.4.7 has been released.