CVE-2023-50708
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison (instead of Yii::$app->getSecurity()->compareString()). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison (instead of Yii::$app->getSecurity()->compareString()). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
CVE-2023-50708- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
EUVDEUVD-2023-3310
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison (instead of Yii::$app->getSecurity()->compareString()). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
EUVD-2023-3310- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8vh-p74j-x9xp
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
Impact
What kind of vulnerability is it? Who is impacted?
Original Report:
The Oauth1/2 "state" and OpenID Connect "nonce" is vulnerable for a "timing attack" since it's compared via regular string comparison (instead of
Yii::$app->getSecurity()->compareString()).
Affected Code:
-
OAuth 1 "state"
-
OAuth 2 "state"
-
OpenID Connect "nonce"
Patches
Has the problem been patched? What versions should users upgrade to?
TBD: Replace strcmp with Yii::$app->getSecurity()->compareString()).
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
not as far as I see.
References
Are there any links users can visit to find out more?
- Record
GHSA-w8vh-p74j-x9xp- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
NVD
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison (instead of Yii::$app->getSecurity()->compareString()). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
CVE-2023-50708- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison (instead of Yii::$app->getSecurity()->compareString()). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
CVE-2023-50708- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVGHSA-w8vh-p74j-x9xp
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
Impact
What kind of vulnerability is it? Who is impacted?
Original Report:
The Oauth1/2 "state" and OpenID Connect "nonce" is vulnerable for a "timing attack" since it's compared via regular string comparison (instead of
Yii::$app->getSecurity()->compareString()).
Affected Code:
-
OAuth 1 "state"
-
OAuth 2 "state"
-
OpenID Connect "nonce"
Patches
Has the problem been patched? What versions should users upgrade to?
TBD: Replace strcmp with Yii::$app->getSecurity()->compareString()).
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
not as far as I see.
References
Are there any links users can visit to find out more?
- Record
GHSA-w8vh-p74j-x9xp- CVSS 3.1
- 0.0 None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yiisoft/yii2-authclientPackagist |
through 2.2.14 | 2.2.15 |
yiisoft/yii2-authclientPackagist |
before 2.2.15, plus listed versions 2.0.02.0.0-beta2.0.0-rc2.0.12.0.2 Show 28 moreShow less2.0.32.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9 |
2.2.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50708 is a medium vulnerability (CVSS 6.1) in Yiiframework Yii2-authclient, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in yiisoft/yii2-authclient 2.2.15.
References
github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp
nvd.nist.gov/vuln/detail/CVE-2023-50708