Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-50708 Details

Description

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:6.1 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158	CVE	Product
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121	CVE	Product
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420	CVE	Product
https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248	CVE	Issue TrackingPatch
https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp	CVE	ExploitPatchThird Party Advisory
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158	[email protected]	Product
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121	[email protected]	Product
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420	[email protected]	Product
https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248	[email protected]	Issue TrackingPatch
https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp	[email protected]	ExploitPatchThird Party Advisory

see all 10 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Weakness Not in a Standard CWE Category	[email protected]
CWE-203	Observable Discrepancy	[email protected]

Affected Products

Product	Versions
yiiframework yii2-authclient	< 2.2.15
CPE cpe:2.3:a:yiiframework:yii2-authclient:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jan 8, 2024	Initial Analysis	[email protected]
Dec 22, 2023	New CVE Received	[email protected]