Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:35:52 +0000 CVE-2023-50708 — yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implemen… https://cve.radiocsirt.org/vuln/cve-2023-50708 <p><strong>Affected:</strong> yiisoft yii2-authclient</p> <p>yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app-&gt;getSecurity()-&gt;compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.</p> <p><strong>Affected:</strong> yiisoft yii2-authclient</p> <p>yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app-&gt;getSecurity()-&gt;compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/cve-2023-50708