CVE-2023-37260

HIGH
Published Jul 6, 20232y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jul 6, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-209

Affected Products 1

VendorProductVersionRange
thephpleagueoauth2-server*≥8.3.2  –  <8.5.3

References 3

  • github.com https://github.com/thephpleague/oauth2-server/pull/1353
    Patch
  • github.com https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3
    Release Notes
  • github.com https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
    Vendor Advisory

Remediation

  • github.com https://github.com/thephpleague/oauth2-server/pull/1353
    Patch