CVE-2023-37260 json
league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase
published 2023-07-06 3 y ago modified 2026-09-10 1 mo ago also GHSA-wj7q-gjg8-3cpm , EUVD-2023-2165
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.
Patch / fix
- packagist league/oauth2-server 8.4.2, 8.5.3
- oauth2-server_project oauth2-server 8.5.3
- github.com/thephpleague/oauth2-server#1353 pull request
- github.com/thephpleague/oauth2-server#1359 pull request
- github.com/thephpleague/oauth2-server/releases/tag/8.5.3 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | league/oauth2-server | >=8.3.2, <8.4.2 >=8.5.0, <8.5.3 |
8.4.2 8.5.3 |
Affected products
- thephpleague oauth2-server
- oauth2-server_project oauth2-server
Classification
References
-
github.com
/thephpleague/oauth2-server/pull/1353
web, patch
-
github.com
/thephpleague/oauth2-server/pull/1359
web
-
github.com
/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
web, vendor-advisory
-
github.com
/thephpleague/oauth2-server/releases/tag/8.5.3
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-37260
advisory
-
github.com
/thephpleague/oauth2-server
package
Sources
- CVE List CVE-2023-37260
- GitHub Advisory GHSA-wj7q-gjg8-3cpm
- NVD CVE-2023-37260
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.