AIKIDO-2026-131230

TL;DR

authenticate() on the rest_authentication_errors filter treats a Bearer token as an HMAC of the HTTP method, host, URI, body, and X-Timestamp. When HiiveConnection::get_auth_token() is empty, that HMAC is computed with hash('sha256', '') as the secret, so anyone can forge a matching Bearer token. A matching token causes wp_set_current_user() to run for the first administrator, which authenticates the REST request as that admin. The fix returns early when no Hiive connection token is stored instead of verifying a signature against an empty secret.