https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:27:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-218892 EUVD-2026-218892 https://cve.radiocsirt.org/vuln/euvd-2026-218892 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27580 <p>CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user&#39;s hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user&#39;s password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.</p> <p>CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user&#39;s hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user&#39;s password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-27580 https://cve.radiocsirt.org/vuln/ghsa-c5vj-f36q-p9vg <p><strong>Affected:</strong> Packagist: codeigniter4/shield</p> <p>### Impact An improper implementation was found in the password storage process.</p> <p>All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible.</p> <p>If an attacker gets (1) the user&#39;s hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user&#39;s password.</p> <p>### Patches Upgrade to Shield v1.0.0-beta.4 or later.</p> <p>After upgrading, all users’ hashed passwords should be updated (saved to the database). See https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.</p> <p>### Workarounds None.</p> <p>### References - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords - https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html - https://www.scottbrady91.com/authentication/beware-of-password-shucking</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield) * Email us at [security@codeigniter.com](mailto:security@codeigniter.com)</p> <p><strong>Affected:</strong> Packagist: codeigniter4/shield</p> <p>### Impact An improper implementation was found in the password storage process.</p> <p>All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible.</p> <p>If an attacker gets (1) the user&#39;s hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user&#39;s password.</p> <p>### Patches Upgrade to Shield v1.0.0-beta.4 or later.</p> <p>After upgrading, all users’ hashed passwords should be updated (saved to the database). See https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.</p> <p>### Workarounds None.</p> <p>### References - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords - https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html - https://www.scottbrady91.com/authentication/beware-of-password-shucking</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield) * Email us at [security@codeigniter.com](mailto:security@codeigniter.com)</p> https://cve.radiocsirt.org/vuln/ghsa-c5vj-f36q-p9vg https://cve.radiocsirt.org/vuln/gsd-2023-27580 gsd-2023-27580 https://cve.radiocsirt.org/vuln/gsd-2023-27580