Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

yiisoft/yii2-authclient

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

    CVE-2023-50708 · GHSA-w8vh-p74j-x9xp

    Affected
    • Packagist yiisoft/yii2-authclient <= 2.2.14
    Fixed in
    2.2.15· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth1/2 "state" and OpenID Connect "nonce" is vulnerable for a "timing attack" since it's compared via regular string comparison (instead of Yii::$app-getSecurity()-compareString()). Affected Code: 1. OAuth 1 "state" https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 3. OAuth 2 "state" https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 4. OpenID Connect "nonce" https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 Patches Has the problem been patched? What versions should users upgrade to? TBD: Replace strcmp with Yii::$app-getSecurity()-compareString()). Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? not as far as I see. References Are there any links users can visit to find out more?

    Recommended action: Upgrade to 2.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.8PackagistPublished

    yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable

    CVE-2023-50714 · GHSA-rw54-6826-c8j5

    Affected
    • Packagist yiisoft/yii2-authclient < 2.2.15
    Fixed in
    2.2.15· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth2 PKCE implementation is vulnerable in 2 ways: 1. The authCodeVerifier should be removed after usage (similar to 'authState') 2. There is a risk for a "downgrade attack" if PKCE is being relied on for CSRF protection. Patches Has the problem been patched? What versions should users upgrade to? 2.2.15 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? not known yet. References Are there any links users can visit to find out more?

    Recommended action: Upgrade to 2.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →