Is revealing just the AUTH_KEY a security issue?

Well, AUTH_KEY and it´s brothers where introduced in WordPress 2.6 to improve safety for logged in users. They are used to encrypt and validate the information in your backend login cookie.

While revealing the AUTH_KEY alone might not be a real security issue, you should nevertheless not output/use this anywhere to give less surface for attacks.

Furthermore I don´t see why you would use the AUTH_KEY to prepare a folder/download link. I think it would be much better to use something like time() to generate folder names if you want randomness or uniqueness or whatever without compromising the security of the system.

Update: I opened a thread in the plugins support area. Let´s see if the author responds to it.

Related Posts:

  1. Unwanted Links and Spam WordPress Pages and Posts
  2. I found this in a plugin. What does it do? is it dangerous?
  3. Disabled plugins are they security holes – rumor or reality?
  4. What could a hacker do with my wp-config.php
  5. How Can I Securely Implement a Password-less Login Feature?
  6. Security and .htaccess
  7. Are there procedures to prevent malicious plugin updates?
  8. Should we use plugins that aren’t available from the official WordPress site?
  9. Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
  10. Where should my plugin POST to?
  11. Security error WP 4.0 + WP phpBB Bridge [closed]
  12. Should I install plugins to my WordPress installation from web sites having in URL “nulled” or, “null”?
  13. Disabled plugins are security holes – rumor or reality?
  14. Should I use RIPS tool to test my themes and plugins?
  15. Author Specific URL’s in WordPress
  16. While Using Static Pages, How Can I Get /blog into the URL of Each Post?
  17. Prevent Brute Force Attack
  18. Upgrading WordPress 4.0 asks for FTP password
  19. I need to generate the CSS for my plugin from a function, how do i map a request to a function in the front-end?
  20. How Restrict access to admin dashboard by specific static ip?
  21. When is it useful to use wp_verify_nonce
  22. Protecting against malicious code in WordPress plugin updates
  23. How can I pass a variable to a page with a SEF url?
  24. custom taxonomy and custom post type url conflict
  25. rms_unique_wp_mu_pl_fl_nm.php
  26. Weird problems after recovery from security breach
  27. How can we deal with unmaintained plugins with vulnerabilities?
  28. Security issues with WP sites
  29. Escape when echoed
  30. Preventing BFA in WordPress without using a plugin
  31. Best way to hook a custom url?
  32. How can I make uploaded images in the editor load with HTTPS?
  33. Changed permalink structure. Need help with redirecting old posts
  34. How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
  35. WordPress filter that hook after each action/filter hook
  36. The safest way to automate WordPress backups
  37. wp_create_nonce function doesn’t work inside a plugin?
  38. How can I change a plugin’s URL?
  39. Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)
  40. Nonce failing on form submission
  41. Why can’t I access my Intranet LDAPS with NADI?
  42. WordPress shows error related to allow_url_fopen
  43. Ability to automatically redirect a URL
  44. Stop Plugin Enumeration [closed]
  45. URL parameters causing 404 on home page, but nowhere else
  46. Hack-Proof OR Security in WordPress — is it real?
  47. Redirect to another page using contact form 7? [closed]
  48. Security and Must Use Plugins
  49. Is Timthumb still broken? What security measures should be taken?
  50. Is it safe to use admin-ajax.php in the frontend?
  51. How to protect WordPress from security scanner [closed]
  52. Specific way to allow WordPress users to view their current password? And edit it?
  53. How to prevent plugins from sniffing/stealing other plugins’ options?
  54. How to deal with Slow HTTP POST (slowloris) vulnerability
  55. Running multiple security plugins
  56. Need to change link URL embedded in multiple posts to new link URL
  57. how to replace hostnames on certain external links?
  58. How to rewrite URL and get the values?
  59. How to access the WordPress DB from a plugin file
  60. If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?
  61. WP Insert Post If user refreshes override new post
  62. 404 errors when updating options in admin dashboard
  63. Website Captcha Error: The reCAPTCHA wasn’t entered correctly
  64. WordPress search shows protected content
  65. How to hide particular plain text with link from different subscribers
  66. Can I disable xml-rpc by setting it to false?
  67. Help to Create a Simple Plugin to make a post
  68. Add a parameter at the end of the url and prettify
  69. Content-Security-Policy implementation with WordPress W3Total Cache plugin installed
  70. insert og image link in wordpress post
  71. How to generate expiring URL of the page?
  72. Having multiple URL structure for wordpress blog
  73. “Fire Secure” menu item
  74. Some resources of my website are pointing to www.mysite.com/dev/ and trying to get rid of that append has been a headache
  75. How do you remove question mark in URL in get method?
  76. https rewrite not working for All in one security Brute force > rename login url
  77. WordPress drop domain alias
  78. URL Case Sensitivity (Unbounce Landing Pages)
  79. Infinite 301 redirects after definitions in “Redirections” plugin?
  80. Redux framework somehow added to my site, can’t locate in plugins
  81. Using permalinks with parameters
  82. wp_verify_nonce fails always
  83. Validating values using Settings API?
  84. How To Rewrite WordPress Pages URL Only?
  85. using .htaccess only for wordpress security no plugins
  86. How can I process all requests for a given directory in a URL with my plugin?
  87. Why links are not linked if edited comment?
  88. Problem with permissions in wp-content/plugins
  89. My WP site and password was hacked, what to do? [closed]
  90. map urls to plugins
  91. How to resolve these findings from security audit
  92. Fetching Video From YouTube Automatically [closed]
  93. How I can hide my wp folders from Inspect Element (Developer Tools)
  94. How to Find WordPress site has backdoor login Codes
  95. How to create a custom wordpress plugin for a specific functionality?
  96. How to rename files during upload to a random string?
  97. Is it a good idea to restrict the REST API
  98. WordPress.Security.NonceVerification.Recommended
  99. How to Handle? vp_page Parameter in WordPress and Resolve Google Search Console Validation Issues?
  100. Trying to Find the PHP File/Function that Handles a Specific Form Action URL