Index: wp-includes/pluggable.php
===================================================================
--- wp-includes/pluggable.php	(revision 19732)
+++ wp-includes/pluggable.php	(working copy)
@@ -506,13 +506,13 @@
  * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
  * @return bool|int False if invalid cookie, User ID if valid.
  */
-function wp_validate_auth_cookie($cookie = '', $scheme = '') {
-	if ( ! $cookie_elements = wp_parse_auth_cookie($cookie, $scheme) ) {
-		do_action('auth_cookie_malformed', $cookie, $scheme);
+function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {
+	if ( ! $cookie_elements = wp_parse_auth_cookie( $cookie, $scheme ) ) {
+		do_action( 'auth_cookie_malformed', $cookie, $scheme );
 		return false;
 	}
 
-	extract($cookie_elements, EXTR_OVERWRITE);
+	extract( $cookie_elements, EXTR_OVERWRITE );
 
 	$expired = $expiration;
 
@@ -522,30 +522,36 @@
 
 	// Quick check to see if an honest cookie has expired
 	if ( $expired < time() ) {
-		do_action('auth_cookie_expired', $cookie_elements);
+		do_action( 'auth_cookie_expired', $cookie_elements );
 		return false;
 	}
 
-	$user = get_user_by('login', $username);
+	$user = get_user_by( 'login', $username );
 	if ( ! $user ) {
-		do_action('auth_cookie_bad_username', $cookie_elements);
+		do_action( 'auth_cookie_bad_username', $cookie_elements );
 		return false;
 	}
 
-	$pass_frag = substr($user->user_pass, 8, 4);
+	$pass_frag = substr( $user->user_pass, 8, 4 );
 
-	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
-	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+	$key = wp_hash( $username . $pass_frag . '|' . $expiration, $scheme );
+	$hash = hash_hmac( 'md5', $username . '|' . $expiration, $key );
 
 	if ( $hmac != $hash ) {
-		do_action('auth_cookie_bad_hash', $cookie_elements);
+		do_action( 'auth_cookie_bad_hash', $cookie_elements );
 		return false;
 	}
+	
+	$user = apply_filters( 'validate_auth_cookie', $user );
+	if ( $user === false ) {
+		do_action( 'auth_cookie_invalid', $cookie_elements );
+		return false;
+	}
 
 	if ( $expiration < time() ) // AJAX/POST grace period set above
 		$GLOBALS['login_grace_period'] = 1;
 
-	do_action('auth_cookie_valid', $cookie_elements, $user);
+	do_action( 'auth_cookie_valid', $cookie_elements, $user );
 
 	return $user->ID;
 }