GitHub Advisoryadvisory · Packagist

GHSA-xm3x-4ph3-3x9c friendsofsymfony/oauth2-php open redirection in oauth

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: friendsofsymfony/oauth2-php
Severity: Moderate
Reviewed: 2024-05-15

Affected packages

• Packagist friendsofsymfony/oauth2-php: < 1.3.0 → fixed in 1.3.0

Description

An open redirection vulnerability has been identified in the friendsofsymfony/oauth2-php library, which could potentially expose users to unauthorized redirects during the OAuth authentication process. This vulnerability has been addressed by implementing an exact check for the domain and port, ensuring more secure redirection.

References

https://github.com/FriendsOfSymfony/oauth2-php/commit/606b8ea1c3c927c272ac1409116332ad5a2ed94c web
https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/oauth2-php/2020-03-03-1.yaml web
https://github.com/FriendsOfSymfony/oauth2-php package
https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0 web