CVE-2023-50714
The Oauth2 PKCE implementation is vulnerable
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage (similar to authState). Second, there is a risk for a downgrade attack if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
The Oauth2 PKCE implementation is vulnerable
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage (similar to authState). Second, there is a risk for a downgrade attack if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
CVE-2023-50714- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-918, CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2023-3295
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage (similar to authState). Second, there is a risk for a downgrade attack if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
EUVD-2023-3295- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rw54-6826-c8j5
yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable
Impact
What kind of vulnerability is it? Who is impacted?
Original Report:
The Oauth2 PKCE implementation is vulnerable in 2 ways:
- The
authCodeVerifiershould be removed after usage (similar to 'authState')- There is a risk for a "downgrade attack" if PKCE is being relied on for CSRF protection.
Patches
Has the problem been patched? What versions should users upgrade to?
2.2.15
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
not known yet.
References
Are there any links users can visit to find out more?
- Record
GHSA-rw54-6826-c8j5- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
NVD
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage (similar to authState). Second, there is a risk for a downgrade attack if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
CVE-2023-50714- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-347, CWE-918, CWE-287
- Updated
- 2026-11-02
OSV
The Oauth2 PKCE implementation is vulnerable
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage (similar to authState). Second, there is a risk for a downgrade attack if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Record
CVE-2023-50714- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-347, CWE-918
- Updated
- 2026-11-02
OSVGHSA-rw54-6826-c8j5
yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable
Impact
What kind of vulnerability is it? Who is impacted?
Original Report:
The Oauth2 PKCE implementation is vulnerable in 2 ways:
- The
authCodeVerifiershould be removed after usage (similar to 'authState')- There is a risk for a "downgrade attack" if PKCE is being relied on for CSRF protection.
Patches
Has the problem been patched? What versions should users upgrade to?
2.2.15
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
not known yet.
References
Are there any links users can visit to find out more?
- Record
GHSA-rw54-6826-c8j5- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-287, CWE-347
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yiisoft/yii2-authclientPackagist |
before 2.2.15 | 2.2.15 |
yiisoft/yii2-authclientPackagist |
before 2.2.15, plus listed versions 2.0.02.0.0-beta2.0.0-rc2.0.12.0.2 Show 28 moreShow less2.0.32.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9 |
2.2.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50714 is a medium vulnerability (CVSS 6.8) in Yiiframework Yii2-authclient, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in yiisoft/yii2-authclient 2.2.15.
References
github.com/yiisoft/yii2-authclient/security/advisories/GHSA-rw54-6826-c8j5
nvd.nist.gov/vuln/detail/CVE-2023-50714