<![CDATA[Urgent Security update for OIDC plugin Wordpress]]>https://wordpress.org/plugins/daggerhart-openid-connect-generic/

Update 3.11.1
After manual update:

OpenID Connect Generic - Security Configuration Required

Your OpenID Connect authentication is using an insecure fallback method. You must configure the JWKS endpoint in plugin settings as soon as possible.

The current insecure fallback will be removed in version 3.12.0. After that update, authentication will fail until the JWKS endpoint is configured.

Common JWKS endpoints:
• Keycloak: https://your-domain/realms/your-realm/protocol/openid-connect/certs
• Auth0: https://your-domain.auth0.com/.well-known/jwks.json
• Okta: https://your-domain.okta.com/oauth2/default/v1/keys
• Azure AD: https://login.microsoftonline.com/your-tenant/discovery/v2.0/keys
• Google: https://www.googleapis.com/oauth2/v3/certs

I tried to manually update within Wordpress Developer app but login got broken, had to restore.

3.11.0

SECURITY RELEASE

Security: Added JWT signature verification using JWKS to prevent token forgery
Security: Enhanced token claim validation (exp, aud, iss, iat, nonce)
Security: Replaced weak state generation with cryptographically secure random_bytes()
Security: Fixed open redirect vulnerability in authentication flow
Security: Restricted SSL verification bypass to local development environments only
Security: Added nonce protection to debug mode to prevent information disclosure
Security: Added SSRF protection by default through use of wp_safe_remote_* functions
Feature: Added JWKS endpoint configuration setting
Feature: Added OpenID Connect discovery document support
Feature: Added customizable login button text setting
Improvement: Migrated to Composer-managed dependencies
Fix: Corrected issuer validation to properly extract base URL from endpoints
Fix: Identity token timestamp tracking

]]>https://forum.cloudron.io/topic/15059/urgent-security-update-for-oidc-plugin-wordpressRSS for NodeMon, 13 Jul 2026 18:14:41 GMTThu, 12 Feb 2026 13:27:07 GMT60<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Sat, 14 Feb 2026 00:19:24 GMT]]>@girish I see it now, that’s great, thank you!

]]>https://forum.cloudron.io/post/120188https://forum.cloudron.io/post/120188Sat, 14 Feb 2026 00:19:24 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 23:45:12 GMT]]>@dsp76 With the latest developer packages + OIDC plugin 3.11.3 , it should work .

@d19dotca https://forum.cloudron.io/topic/2586/wordpress-developer-package-updates/88 is the package release .

]]>https://forum.cloudron.io/post/120184https://forum.cloudron.io/post/120184Fri, 13 Feb 2026 23:45:12 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 21:34:15 GMT]]>@imc67 I checked just a bit ago but didn’t actually see any update to the Developer one yet. Maybe I checked too early. Hopefully we see it soon so we can update the plugin.

]]>https://forum.cloudron.io/post/120181https://forum.cloudron.io/post/120181Fri, 13 Feb 2026 21:34:15 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 21:27:37 GMT]]>First update app, then update plugin

]]>https://forum.cloudron.io/post/120180https://forum.cloudron.io/post/120180Fri, 13 Feb 2026 21:27:37 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 20:20:37 GMT]]>And what needs to be done on WordPress (Developer)?

]]>https://forum.cloudron.io/post/120172https://forum.cloudron.io/post/120172Fri, 13 Feb 2026 20:20:37 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 18:21:00 GMT]]>Yes tried manually on 2 sites and it’s working!
Thanks for the effort and results 🙏

]]>https://forum.cloudron.io/post/120164https://forum.cloudron.io/post/120164Fri, 13 Feb 2026 18:21:00 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 18:10:23 GMT]]>This should be fixed now with the latest package.

]]>https://forum.cloudron.io/post/120161https://forum.cloudron.io/post/120161Fri, 13 Feb 2026 18:10:23 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 13:30:56 GMT]]>@dsp76 said in Urgent Security update for OIDC plugin Wordpress:

switch to app based authorisation meanwhile and deactivate the plugin?

That's what I just did. I knew OIDC is more trouble than its worth. BTW, cloning the app won't work. Install a new WP managed app, then import a backup if you decide to go that route.

]]>https://forum.cloudron.io/post/120132https://forum.cloudron.io/post/120132Fri, 13 Feb 2026 13:30:56 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 13:29:02 GMT]]>@girish could you please explain? is a broken 3.11.3 more insecure than an insecure older version? Wouldn't it be better to switch to app based authorisation meanwhile and deactivate the plugin?

]]>https://forum.cloudron.io/post/120131https://forum.cloudron.io/post/120131Fri, 13 Feb 2026 13:29:02 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 11:56:13 GMT]]>There's quite a bit of changes needed: the plugin has also moved to composer, we need a new platform release to adjust for the JWKS key handling, some changes to the package to whitelist the cloudron OIDC server since it appears WP is blocking it etc.

I think if someone is waiting for this, this will take a while. Best to not update the plugin (or if you already updated, you should roll back somehow).

]]>https://forum.cloudron.io/post/120125https://forum.cloudron.io/post/120125Fri, 13 Feb 2026 11:56:13 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 10:28:30 GMT]]>I am testing it right now, let's see what other issues are there.

]]>https://forum.cloudron.io/post/120117https://forum.cloudron.io/post/120117Fri, 13 Feb 2026 10:28:30 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 10:20:24 GMT]]>@humptydumpty said in Urgent Security update for OIDC plugin Wordpress:

@girish do we need to do anything on the user end?

Same question here. Is it something we should manually set? What do we set correctly to work with cloudron?

]]>https://forum.cloudron.io/post/120116https://forum.cloudron.io/post/120116Fri, 13 Feb 2026 10:20:24 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Fri, 13 Feb 2026 05:25:01 GMT]]>Looks like just a short bit ago version 3.11.3 is out now.

https://github.com/oidc-wp/openid-connect-generic/issues/633#issuecomment-3894814402

I've released 3.11.3 which provides a setting for the issuer url. This seems like the the most reliable way to ensure each site can adjust depending on their IDP.

]]>https://forum.cloudron.io/post/120113https://forum.cloudron.io/post/120113Fri, 13 Feb 2026 05:25:01 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Thu, 12 Feb 2026 20:59:32 GMT]]>@girish do we need to do anything on the user end?

]]>https://forum.cloudron.io/post/120110https://forum.cloudron.io/post/120110Thu, 12 Feb 2026 20:59:32 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Thu, 12 Feb 2026 18:50:46 GMT]]>The plugin has also started requiring the 'alg' param in JWKS keys. The field is optional (https://datatracker.ietf.org/doc/html/rfc7517#section-4.4) , but I have added it to our oidcserver now.

]]>https://forum.cloudron.io/post/120102https://forum.cloudron.io/post/120102Thu, 12 Feb 2026 18:50:46 GMT<![CDATA[Reply to Urgent Security update for OIDC plugin Wordpress on Thu, 12 Feb 2026 18:22:22 GMT]]>The current plugin version has some issues, I have left a note here - https://github.com/oidc-wp/openid-connect-generic/issues/633

]]>https://forum.cloudron.io/post/120099https://forum.cloudron.io/post/120099Thu, 12 Feb 2026 18:22:22 GMT