https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T12:59:40.035305+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-10084 EUVD-2026-10084 2026-10-04T12:59:40.102658+00:00 EUVD-2026-10084 https://cve.radiocsirt.org/vuln/fkie_cve-2023-48708 fkie_cve-2023-48708 2026-10-04T12:59:40.102694+00:00

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.

 https://cve.radiocsirt.org/vuln/ghsa-j72f-h752-mx4w GHSA-j72f-h752-mx4w — Insertion of Sensitive Information into Log 2026-10-04T12:59:40.102729+00:00

Affected: Packagist: codeigniter4/shield

### Impact If successful login attempts are recorded, the raw tokens are stored in the log table. If a malicious person somehow views the data in the log table, he or she can obtain a raw token, which can then be used to send a request with that user's authority.

When you (1) **use the following authentiactors**, - [AccessTokens](https://codeigniter4.github.io/shield/references/authentication/tokens/) (`tokens`) - [JWT](https://codeigniter4.github.io/shield/addons/jwt/) (`jwt`) - [HmacSha256](https://codeigniter4.github.io/shield/references/authentication/hmac/) (`hmac`)

and you (2) **log successful login attempts**, the raw tokens are stored.

### Patches Upgrade to Shield v1.0.0-beta.8 or later.

### Workarounds Disable logging for successful login attempts by the configuration files.

- AccessTokens or HmacSha256 - Set `Config\AuthToken::$recordLoginAttempt` to `Auth::RECORD_LOGIN_ATTEMPT_FAILURE` or `Auth::RECORD_LOGIN_ATTEMPT_NONE` - JWT - Set `Config\AuthJWT::$recordLoginAttempt` to `Auth::RECORD_LOGIN_ATTEMPT_FAILURE` or `Auth::RECORD_LOGIN_ATTEMPT_NONE`

### References - https://codeigniter4.github.io/shield/getting_started/authenticators/

### For more information If you have any questions or comments about this advisory: * Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield) * Email us at [security@codeigniter.com](mailto:security@codeigniter.com)

 https://cve.radiocsirt.org/vuln/gsd-2023-48708 gsd-2023-48708 2026-10-04T12:59:40.102769+00:00 gsd-2023-48708