PT-2026-27123 · Unknown · Hybridauth

Jstyles · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-4587

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HybridAuth versions up to 3.12.2

Description A flaw exists in HybridAuth related to improper certificate validation within the SSL Handler component. This is due to the manipulation of the curlOptions argument in the src/HttpClient/Curl.php file. The issue is remotely exploitable and is considered to have high complexity and difficult exploitability. The project was notified of the issue but has not yet responded.

Recommendations Update HybridAuth to a version beyond 3.12.2.

Correção

Improper Certificate Validation

Improper Authentication

Enumeração de Fraquezas

CWE-295

CWE-287

Identificadores relacionados

CVE-2026-4587

GHSA-R3HF-Q3MF-7H6W

Produtos afetados

Hybridauth

Referências · 8

• https://github.com/hybridauth/hybridauth/issues/1444 · Nota
• https://github.com/hybridauth/hybridauth · Nota
• https://vuldb.com/?ctiid.352423 · Nota
• https://osv.dev/vulnerability/GHSA-r3hf-q3mf-7h6w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4587 · Nota de Segurança
• https://vuldb.com/?submit.775463 · Nota
• https://vuldb.com/?id.352423 · Nota
• https://twitter.com/VulmonFeeds/status/2036119423195525545 · Publicação no Twitter