search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.49k stars 1.12k forks source link

League/Oauth2-Server Key Exposure In Exception Message #1388

Closed ankitdn closed 6 months ago

ankitdn commented 6 months ago

Bug Description: During a security vulnerability scan of my Laravel backend application using Vulert, I discovered a potential security risk associated with the League/Oauth2-Server package.

Details: The issue involves key exposure within exception messages generated by the package. This vulnerability could potentially lead to the disclosure of sensitive information and poses a security threat to applications using the League/Oauth2-Server.

References:

Sephster commented 6 months ago

Thanks for reporting this but it is no longer a risk. It was patched in version 8.4.2 as per the CVE report. If you use a version later than this you should be fine.

ankitdn commented 6 months ago

Thank you. I'll update the version.