All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login Security & Risk Analysis

The 'login-with-azure' plugin v2.2.6 exhibits a generally good security posture, with strong adherence to best practices such as 100% SQL prepared statements and a high percentage of properly escaped output. The static analysis reveals a limited attack surface with no unprotected entry points. Nonce and capability checks are present on the identified entry points (shortcodes), indicating an effort to secure these interactions.

However, the vulnerability history is a significant concern. The plugin has two known CVEs, one of which was critical, and the other medium. While there are currently no unpatched vulnerabilities, the historical presence of critical and medium severity issues, including Authentication Bypass and Cross-site Scripting, suggests a pattern of past security weaknesses that required significant remediation. The taint analysis, while showing no critical or high severity flows, did identify 5 flows with unsanitized paths, which, combined with the historical XSS vulnerability, warrants attention and potentially a closer manual review of these unsanitized paths.

In conclusion, while the current version demonstrates improved security practices and a clean slate of unpatched vulnerabilities, the past critical security incidents cannot be ignored. The presence of unsanitized paths in the taint analysis, though not leading to critical issues in this scan, is a red flag. Users should remain vigilant and ensure they are always on the latest version, as past critical vulnerabilities indicate a potential for future risks if development practices are not consistently robust.