# CVE-2026-122220

Published articles for CVE-2026-122220.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-122220 - WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

DevFeed: [CVE-2026-122220 - WPO365 LOGIN before 45.2 SAML Replay Protection Bypass](<https://devfeed.tech/articles/cve-2026-122220-wpo365-login-before-45-2-saml-replay-protection-bypass-117778.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-122220>)

Author: CVEFEED.io; vulncheck.com

Published: 2026-11-04T20:19:12Z

Content type: article

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [saml](<https://devfeed.tech/topics/saml.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [capture](<https://devfeed.tech/tags/capture.md>), [critical](<https://devfeed.tech/tags/critical.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-122220](<https://devfeed.tech/tags/cve-2026-122220.md>), [login](<https://devfeed.tech/tags/login.md>), [protection](<https://devfeed.tech/tags/protection.md>), [saml](<https://devfeed.tech/tags/saml.md>), [version](<https://devfeed.tech/tags/version.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

WPO365 | LOGIN versions before 45.2 have a SAML replay vulnerability. A logic error in Saml2_Service::check_message_id() returns before saving processed message IDs, so the duplicate check never works. An attacker who captures a validly signed SAMLResponse can replay it to the ACS endpoint during the assertion's validity window to log in as the victim, including an administrator. The excerpt does not provide remediation details.

### Source excerpt

CVE ID :CVE-2026-122220 Published : Nov. 4, 2026, 8:19 p.m. | 2 hours, 3 minutes ago Description :WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...