CVE-2023-50714

Packagist/yiisoft/yii2-authclient CVE-2023-50714: medium 6.8, EPSS 0.49%

yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable

Action: Upgrade yiisoft/yii2-authclient to 2.2.15 or later.

composer require yiisoft/yii2-authclient:2.2.15

Affected

Fixed versions

Sources

• osv: GHSA-rw54-6826-c8j5
• https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5
• https://nvd.nist.gov/vuln/detail/CVE-2023-50714
• https://github.com/yiisoft/yii2-authclient/commit/721ed974bc44137437b0cdc8454e137fff8db213
• https://github.com/yiisoft/yii2-authclient
• https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158
• https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121
• https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420

CVE-2023-50714 · published 2023-12-18T19:34:20Z · modified 2026-09-10T03:50:09.131571556Z · JSON