Read the docs
TI-2022-16370 Aliases CVE-2022-35943GHSA-5hm8-vh6r-2cjq

SameSite may allow cross-site request forgery (CSRF) protection to be bypassed

Priority HIGH 71CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00611 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed codeigniter4/shield (Packagist): 1.0.0-beta.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codeigniter4shield> 4.3.2, > v1.0.0-beta.2—No fix listedCNA
—codeigniter4/shield (Packagist)1.0.0-beta to before 1.0.0-beta.21.0.0-beta.2Patch availableGHSA-5hm8-vh6r-2cjq
  • shield Vendorcodeigniter4 Affected > 4.3.2, > v1.0.0-beta.2 Fixed in — No fix listed CNA
  • codeigniter4/shield (Packagist) Vendor— Affected 1.0.0-beta to before 1.0.0-beta.2 Fixed in 1.0.0-beta.2 Patch available GHSA-5hm8-vh6r-2cjq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*before 4.2.3Vulnerablecodeigniter4
cpe:2.3:a:codeigniter:shield:1.0.0:beta:*:*:*:*:*:*1.0.0 betaVulnerablecodeigniter4
  • cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:* Versions before 4.2.3 Vulnerable ·codeigniter4
  • cpe:2.3:a:codeigniter:shield:1.0.0:beta:*:*:*:*:*:* Versions 1.0.0 beta Vulnerable ·codeigniter4

Remediation

  • Fix · GHSA-5hm8-vh6r-2cjq codeigniter4/shield (Packagist) Fixed in 1.0.0-beta.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35943
  2. 2026-10-03 Alias added: GHSA-5hm8-vh6r-2cjq

References

Exploit 1

Advisory 3

Other 3

  • TI-2014-07135 CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it… CVSS 3.0CRITICAL 9.8
  • TI-2022-06025 Deserialization of Untrusted Data in Codeigniter4 CVSS 3.1CRITICAL 9.8
  • TI-2024-27591 A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily… CVSS 3.1HIGH 7.5
  • TI-2014-07136 CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by… CVSS 3.0CRITICAL 9.8
  • TI-2024-19671 CodeIgniter4 Language class DoS Vulnerability CVSS 3.1HIGH 7.5
  • TI-2022-18660 Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4 CVSS 3.1MEDIUM 4.3
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences