p PatchFirst

CVE-2023-50708

CVE-2023-50708 · yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.

CVSS 6.1 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • yii2-authclient

    Versions
    • < 2.2.15: Affected

    No fix published

  • yiisoft/yii2-authclient Packagist

    Versions
    • 2.0.0
    • 2.0.0-beta
    • 2.0.0-rc
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.2.0
    • 2.2.1
    • 2.2.10
    • 2.2.11
    • 2.2.12
    • 2.2.13
    • 2.2.14
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    • 2.2.9
    Affected ranges
    • ECOSYSTEM: < 2.2.15

    Update to 2.2.15

Original sources

Check your server →