CVE-2023-50708

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
yiisoft	yii2-authclient	< 2.2.15

References

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-507097.5Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by CVE-2023-50715.4The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and includin CVE-2023-507104.3Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous reque CVE-2023-507119.8vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 CVE-2023-507125.4Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site CVE-2023-507135.0Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in ver CVE-2023-507148.8yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient p CVE-2023-507154.3Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any CVE-2023-507169.8eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Pri CVE-2023-507175.4NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload CVE-2023-507186.5NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could con CVE-2023-507197.5XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based