{"id":"GHSA-hhw9-35p2-q2c5","aliases":[],"status":"published","title":"Steam Socialite Provider v1 does not correctly validate openid server","description":"### Impact\nThe outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.\n\n### Patches\nThis vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)\n* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2021-01-29T20:51:30Z","modified":"2024-12-02T05:44:34Z","fixes":[{"ecosystem":"Packagist","package":"socialiteproviders/steam","fixed_in":["1.1","3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"socialiteproviders/steam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"socialiteproviders/steam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0"}]}],"versions":["v1.0.0","v1.0.1","v1.1"]}],"references":[{"url":"https://github.com/SocialiteProviders/Steam/security/advisories/GHSA-hhw9-35p2-q2c5","tags":["web"]},{"url":"https://packagist.org/packages/socialiteproviders/steam","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhw9-35p2-q2c5"}],"sources":{"ghsa":[{"id":"GHSA-hhw9-35p2-q2c5","title":"Steam Socialite Provider v1 does not correctly validate openid server","description":"### Impact\nThe outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.\n\n### Patches\nThis vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)\n* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)","status":"published","published":"2021-01-29T20:51:30Z","modified":"2023-01-09T05:04:18Z","cwes":["CWE-346"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"osv":[{"id":"GHSA-hhw9-35p2-q2c5","title":"Steam Socialite Provider v1 does not correctly validate openid server","description":"### Impact\nThe outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.\n\n### Patches\nThis vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)\n* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)","status":"published","published":"2021-01-29T20:51:30Z","modified":"2024-12-02T05:44:34.357512Z","cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:49.28217Z"}]}}