N/A

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.

N/A

N/A

Zend Framework ZendOpenId和Zend_OpenId_Consumer 安全漏洞

Zend Framework 1（ZF1）是美国Zend公司开发的一套开源的PHP5开发框架，它主要用于开发Web程序和服务。ZendOpenId是其中的一个提供了简单API用于构建启用OpenId的站点和身份标识的组件；Zend_OpenId_Consumer是其中的一个被用来在网站上实现OpenId认证计划的类。 ZF1 1.12.4之前版本的ZendOpenId 2.0.2之前版本和Zend_OpenId_Consumer类中的Consumer组件的GenericConsumer类中存在安全漏洞，该

N/A

N/A