| tiêu đề | hybridauth >2.2.0 Improper Certificate Validation (CWE-295) |
|---|
| Mô tả | # Summary
The default cURL configuration in src/HttpClient/Curl.php disables SSL certificate verification, making applications vulnerable to man-in-the-middle (MITM) attacks during OAuth/OIDC authentication flows.
Affected Code
https://github.com/hybridauth/hybridauth/blob/d5667267011ff3fc8409ab239afddc623c6311fe/src/HttpClient/Curl.php#L23-L33
```
protected $curlOptions = [
CURLOPT_TIMEOUT => 30,
CURLOPT_CONNECTTIMEOUT => 30,
CURLOPT_SSL_VERIFYPEER => false, // Verification disabled
CURLOPT_SSL_VERIFYHOST => false, // Host checking disabled
// ... other options
];
```
Maintainers were contacted on 2026-02-01 via email, followed up on 2026-02-20. An issue was created to alert them of a potential problem https://github.com/hybridauth/hybridauth/issues/1444 (no vuln details publicly disclosed). |
|---|
| Người dùng | jstyles (UID 96251) |
|---|
| Đệ trình | 09/03/2026 04:12 (cách đây 7 các tháng) |
|---|
| Kiểm duyệt | 22/03/2026 10:40 (13 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 352423 [HybridAuth đến 3.12.2 SSL src/HttpClient/Curl.php curlOptions xác thực yếu] |
|---|
| điểm | 17 |
|---|