PT-2026-27123 · Unknown · Hybridauth

Jstyles · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4587

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HybridAuth versions up to 3.12.2

Description A flaw exists in HybridAuth related to improper certificate validation within the SSL Handler component. This is due to the manipulation of the curlOptions argument in the src/HttpClient/Curl.php file. The issue is remotely exploitable and is considered to have high complexity and difficult exploitability. The project was notified of the issue but has not yet responded.

Recommendations Update HybridAuth to a version beyond 3.12.2.

Fix

Improper Certificate Validation

Improper Authentication

Weakness Enumeration

CWE-295

CWE-287

Related Identifiers

CVE-2026-4587

GHSA-R3HF-Q3MF-7H6W

Affected Products

Hybridauth

References · 8

• https://osv.dev/vulnerability/GHSA-r3hf-q3mf-7h6w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4587 · Security Note
• https://github.com/hybridauth/hybridauth/issues/1444 · Note
• https://github.com/hybridauth/hybridauth · Note
• https://vuldb.com/?ctiid.352423 · Note
• https://vuldb.com/?submit.775463 · Note
• https://vuldb.com/?id.352423 · Note
• https://twitter.com/VulmonFeeds/status/2036119423195525545 · Twitter Post