High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

d85b71f3b9ce5677279c8e30… Copy

Findings

• high LIFF access-token verify does not check client_id / channel audience

  auth_bypass

  LiffApiClient::verifyAccessToken GETs https://api.line.me/oauth2/v2.1/verify?access_token=… and only requires HTTP 200 plus expires_in > 0. LINE's documented response includes client_id (the LINE Login channel that issued the token); the plugin never compares it to SettingsService::get('general','login_channel_id') or channel_id. Any valid LINE Login access token from any channel (including one the attacker registered) is accepted, profile is fetched from https://api.line.me/v2/profile with that bearer, and LiffUserProcessor proceeds to bind/register/email-merge. Combined with the email auto-link finding this means the attacker does not need the victim site's LIFF app or to be inside LINE's in-app browser: GET /line-hub/liff/ for a uid-0 nonce, POST liff_access_token from their own channel, then POST email=admin@site. LINE's own docs require matching client_id to the configured channel. OAuthClient::verifyIdToken does pass client_id to LINE's ID-token verify, so the OAuth code path is not affected the same way.

  includes/liff/class-liff-api-client.php:49-68

  Recommendation

  After a successful verify response, require isset($body['client_id']) and hash_equals against the configured LINE Login channel ID (fallback Messaging channel ID only if that is what LIFF is bound to). Reject tokens whose audience does not match. Do the same check before getProfile().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.