GCVE - cpe:2.3:a:yiiframework:yii2-authclient:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:yiiframework:yii2-authclient:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Yiiframework (`71cd1b74-9485-5996-b24b-13cca60de3e4`)
Product	Yii2 Authclient (`016c10fb-23dc-5e47-842e-44d70b554173`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:composer/yiisoft/yii2-authclient`	purl2cpe	2026-06-01 10:14:59.300080
`pkg:github/yiisoft/yii2-authclient`	purl2cpe	2026-06-01 10:14:59.300083

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-50714`	vulnerable	2026-06-08 06:16:16.327300	The Oauth2 PKCE implementation is vulnerable MEDIUM (6.8) yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available. Published: 2023-12-22T18:30:03.118Z Updated: 2024-11-27T15:43:11.763Z Open on db.gcve.eu Reference links https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5 https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-50708`	vulnerable	2026-06-08 06:16:16.314665	yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation MEDIUM (6.1) yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available. Published: 2023-12-22T18:25:01.925Z Updated: 2024-08-02T22:16:47.124Z Open on db.gcve.eu Reference links https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.