-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codeigniter4/shield | composer | = 1.0.0-beta | 1.0.0-beta.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The Session authenticator's constructor lacked a check to enforce 'session' mode for CSRF protection. This allowed 'cookie' mode, which is susceptible to subdomain attacks due to cookie inheritance. 2) The login process did not forcibly regenerate CSRF tokens when configuration disallowed regeneration, leaving stale tokens active. The patch introduced a security check in the constructor and added token regeneration in startLogin(), directly addressing these flaws. Both functions were critical points where insecure configurations and token management enabled the bypass.
A Semantic Attack on Google Gemini - Read the Latest Research