-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| league/oauth2-server | composer | >= 8.3.2, < 8.4.2 | 8.4.2 |
| league/oauth2-server | composer | >= 8.5.0, < 8.5.3 | 8.5.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how the CryptKey class handles exception messaging when invalid passphrases are provided with string-based keys. The patches in PR #1353 and PR #1359 specifically modify the exception message in CryptKey's constructor to remove the key value from error output. This indicates the constructor was directly responsible for leaking sensitive key material through exception messages in vulnerable versions.