-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| packbackbooks/lti-1-3-php-library | composer | < 5.0 | 5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from using uniqid() with microtime-based entropy for cryptographic nonce and state generation. The commit de19e8a replaced these with secureRandomString() using random_bytes(64) + SHA-256 hashing. The original implementations in LtiOidcLogin.php's doOidcLoginRedirect method lacked sufficient cryptographic complexity, as uniqid() is not designed for security-sensitive contexts. This matches CWE-330 (Insufficient Randomness) and the advisory's description of predictable values.
Ongoing coverage of React2Shell