OAuth 2.0 client for SSO <= 1.11.3 is vulnerable to Authentication Bypass vulnerability

The OAuth 2.0 client for SSO plugin for WordPress is vulnerable to authentication bypass in versions up to, and including 1.11.3. This is due to the plugin accepting a user supplied email address that is passed to wp_set_auth_cookie() with no further identity validation to verify that the email supplied belongs to the user trying to log in with that email address. This makes it possible for unauthenticated attackers to log in as a site administrator granted they have access to a site admin's email address.