PT-2026-27123 · Unknown · Hybridauth
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X |
Name of the Vulnerable Software and Affected Versions
HybridAuth versions up to 3.12.2
Description
A flaw exists in HybridAuth related to improper certificate validation within the SSL Handler component. This is due to the manipulation of the
curlOptions argument in the src/HttpClient/Curl.php file. The issue is remotely exploitable and is considered to have high complexity and difficult exploitability. The project was notified of the issue but has not yet responded.Recommendations
Update HybridAuth to a version beyond 3.12.2.
Exploit
Fix
Improper Authentication
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hybridauth