-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the _handleSuccessfulLogin method returning the entire user model through asModelSuccess() in vulnerable versions. The user model contained the password hash which was exposed in API responses. The patch (eb93bcb) specifically replaces asModelSuccess() with asSuccess() to prevent serializing sensitive user attributes. This matches both the CWE-200 (exposure) and CWE-522 (insufficient credential protection) classifications, as the function improperly exposed password hashes in successful authentication responses.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| born05/craft-twofactorauthentication | composer | >= 3.3.1, < 3.3.4 | 3.3.4 |
Ongoing coverage of React2Shell