https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:01:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-232652 EUVD-2026-232652 https://cve.radiocsirt.org/vuln/euvd-2026-232652 https://cve.radiocsirt.org/vuln/fkie_cve-2022-35943 <p>Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `&#39;session,&#39;`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)</p> <p>Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `&#39;session,&#39;`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-35943 https://cve.radiocsirt.org/vuln/ghsa-5hm8-vh6r-2cjq <p><strong>Affected:</strong> Packagist: codeigniter4/shield</p> <p>### Impact This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield.</p> <p>For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`).</p> <p>This vulnerability exists whether `Config\Security::$csrfProtection` is `&#39;cookie&#39;` or `&#39;session&#39;`. It is also exploitable whether `Config\Security::$regenerate` is `true` or `false`.</p> <p>### Patches Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**.</p> <p>### Workarounds Do all of the following: - set `Config\Security::$csrfProtection` to `&#39;session&#39;` - remove old session data right after login (immediately after ID and password match) - regenerate CSRF token right after login (immediately after ID and password match)</p> <p>### References - [CodeIgniter4 CSRF Protection](https://codeigniter4.github.io/userguide/libraries/security.html) - [SameSite Attacks](https://canitakeyoursubdomain.name/) - [SameSite Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) - [The great SameSite confusion](https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/)</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue or discussion in [codeigniter4/shield](ht…</p> <p><strong>Affected:</strong> Packagist: codeigniter4/shield</p> <p>### Impact This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield.</p> <p>For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`).</p> <p>This vulnerability exists whether `Config\Security::$csrfProtection` is `&#39;cookie&#39;` or `&#39;session&#39;`. It is also exploitable whether `Config\Security::$regenerate` is `true` or `false`.</p> <p>### Patches Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**.</p> <p>### Workarounds Do all of the following: - set `Config\Security::$csrfProtection` to `&#39;session&#39;` - remove old session data right after login (immediately after ID and password match) - regenerate CSRF token right after login (immediately after ID and password match)</p> <p>### References - [CodeIgniter4 CSRF Protection](https://codeigniter4.github.io/userguide/libraries/security.html) - [SameSite Attacks](https://canitakeyoursubdomain.name/) - [SameSite Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) - [The great SameSite confusion](https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/)</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue or discussion in [codeigniter4/shield](ht…</p> https://cve.radiocsirt.org/vuln/ghsa-5hm8-vh6r-2cjq https://cve.radiocsirt.org/vuln/gsd-2022-35943 gsd-2022-35943 https://cve.radiocsirt.org/vuln/gsd-2022-35943