AIKIDO-2026-88657

TL;DR

The unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions build HMAC messages differently: step 1 signs and returns an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits domain. An attacker can obtain a valid HMAC from step 1 and replay it to step 2 by folding the domain value into the redirect field, completing Hub SSO as a mapped administrator. The fix aligns HMAC canonicalization so both steps sign and verify the same field set.