OWC | Signicat OpenID WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

3.2.5

Findings

2

Worst severity

medium

Content hash

0252f76c9f7349e2e409c644… Copy

Findings

• medium CSRF-able OpenID revoke/refresh REST routes with __return_true

  csrf

  registerRestRoutes registers GET refresh and revoke under owc-signicat-openid/v1 with permission_callback __return_true. revoke() walks enabled IdPs and calls openIDService->revoke for any active session on the request. A malicious page can issue a cross-origin GET with the victim's cookies and force DigiD/eHerkenning logout (or refresh) without a nonce or Origin check.

  src/Services/RouteService.php:129-191

  Recommendation

  Require a same-origin nonce or CSRF token (and prefer POST). Keep session-bound behavior but reject cross-site requests; do not use __return_true for state-changing routes.

• medium Missing REST permission_callback hardening on session mutation endpoints

  missing_permission_callback

  Both refresh and revoke advertise permission_callback __return_true, documenting intentional public access. Combined with cookie session auth this is missing authorization at the REST layer for state-changing operations.

  src/Services/RouteService.php:132-149

  Recommendation

  Replace __return_true with a callback that verifies a REST nonce / logged-in OpenID session intent and rejects cross-site GETs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.