Authentication & Registration Bypass in Newspack Extended Access

Summary: The Newspack Extended Access plugin omits to verify JWT signing on the registration and login JSON endpoint. This permits registration of accounts with arbitrary (user-supplied) details, and auth bypass and account hijack if a target account email is known.

{
  "sub": "1234567890",
  "azp": "12345-abcdef.apps.googleusercontent.com" ,
  "email": "[email protected]"
}