Login with Vipps and MobilePay Security & Risk Analysis

The "login-with-vipps" v1.4.0 plugin exhibits a mixed security posture. While it demonstrates good practices like a high percentage of prepared statements for SQL queries and a reasonable number of nonce and capability checks, there are significant areas of concern. The presence of 4 AJAX handlers without authentication checks creates a direct attack surface for unauthorized actions. Furthermore, the taint analysis revealed 6 flows with unsanitized paths, indicating potential vulnerabilities where user input is not properly validated before being used in sensitive operations, although no critical or high severity issues were identified in this analysis.

The plugin's vulnerability history, while currently showing no unpatched CVEs, includes a past medium-severity Cross-Site Scripting (XSS) vulnerability. This pattern suggests a history of input sanitization issues. The recent vulnerability date further emphasizes the need for vigilance. In conclusion, the plugin has strengths in its SQL handling and some security checks, but the unprotected AJAX endpoints and unsanitized data flows, coupled with a past XSS vulnerability, present notable risks that require attention for a more robust security posture.