WP API · Report #32944
MD5 used for Key-Auth signatures
Informativestatus
4upvotes
29 Oct 2014disclosed
How it was found
https://github.com/WP-API/Key-Auth/blob/f9b74b3e4df667cfb44baba556eafde65fa3aec9/key-auth.php#L65
MD5 is vulnerable to length-extension attacks.
Maybe consider changing this to hash_hmac('sha256', json_encode($args), $secret)?