# Authentication & Registration Bypass in Newspack Extended Access

Newspack Extended Access accepted unsigned JWTs at its Google register/login endpoint, letting attackers register arbitrary accounts or hijack any known-email account.

- Payout: hidden
- Severity: medium
- Program: Automattic
- Found by: xurizaemon0
- Disclosed: 2024-07-05
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2536758
- Library page: https://bugbountylibrary.com/r/h1%3A2536758
- Tags: area:web3 domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:medium tech:jwt tech:wordpress technique:source-review vuln:auth-bypass

**Target:** WordPress REST endpoint /wp-json/newspack-extended-access/v1/google/register
**Root cause:** The REST controller decodes the JWT payload and trusts azp/email claims without verifying the JWT signature against Google's published signing keys.
**Steps:**
1. Read site JS to grab `authenticationSettings.googleClientApiID` (the azp value).
2. Know target email (existing SwG-registered user) or pick arbitrary email for new registration.
3. Craft JWT with payload `{"sub":"1234567890","azp":"<app id>","email":"target@example.org"}` and any/unsigned signature.
4. POST the raw token as `text/plain` body to `/wp-json/newspack-extended-access/v1/google/register`.
5. Response sets authenticated session as the target user.
**How found:** Source review of class-rest-controller.php lines 84-89 revealed the JWT was decoded but signature never checked; noted the earlier admin/editor mitigation was removed in a recent commit, widening impact.
**Exploitation:** Attacker fetches the public Google client ID from site JS, forges an unsigned JWT with the victim's email and that azp, and POSTs it to the register endpoint; the plugin logs the browser in as the victim without signature verification, granting access to their profile/billing data and, if the victim is Admin, full WordPress control.
**Escalation:** Hijacking an Admin/Editor account yields full WordPress access; prior role restriction was removed in commit 4c87c25a. Bulk registration enables DoS.
**Insight:** When a plugin validates a third-party IdP token, check whether it fetches and verifies the IdP's JWKS — decoding claims without signature check is the tell; also diff recent commits for removed role/privilege guards that re-widen impact.