CVE-2026-122220

Name of the Vulnerable Software and Affected Versions WPO365 | LOGIN (wpo365-login) versions prior to 45.2

Description An authentication bypass exists due to a non-functional anti-replay check in the check message id() function within Saml2 Service. A logic error prevents the system from persisting processed SAML message IDs to the wpo365 saml message ids transient storage. Consequently, an attacker who captures a validly-signed SAMLResponse can repeatedly replay it to the ACS endpoint within its assertion validity window to gain unauthorized access as the victim, including administrators.

Recommendations Update WPO365 | LOGIN (wpo365-login) to version 45.2.