CVE-2023-37260

    Dashboard / Vulnerabilities / CVE-2023-37260

    CVE-2023-37260

    Published: 6 Jul 2023Last Modified: 12 Aug 2026

    Summary: league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase

    Details: league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.

    References: https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37260.json, https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm, https://nvd.nist.gov/vuln/detail/CVE-2023-37260, https://github.com/thephpleague/oauth2-server/pull/1353

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0809487d33dd8a2c8c8c04e4a599ba4aadba1ae6
    Fixed -eb91b4190e7f6169053ebf8ffa352d47e756b2ce

    Affected versions

    8.4.1
    8.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-37260 | CVE-DB