Read the docs
TI-2022-22814 Aliases CVE-2022-46170GHSA-6cq5-8cj7-g558

CodeIgniter is vulnerable to improper authentication via Session Handlers

Priority MEDIUM 50CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00912 60th percentileScored 2026-11-07
Fix Fixed CodeIgniter4 (codeigniter4): 4.2.11codeigniter4/framework (Packagist): 4.2.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codeigniter4CodeIgniter4before 4.2.114.2.11Patch availableCNA
—codeigniter4/framework (Packagist)before 4.2.114.2.11Patch availableGHSA-6cq5-8cj7-g558
  • CodeIgniter4 Vendorcodeigniter4 Affected before 4.2.11 Fixed in 4.2.11 Patch available CNA
  • codeigniter4/framework (Packagist) Vendor— Affected before 4.2.11 Fixed in 4.2.11 Patch available GHSA-6cq5-8cj7-g558

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*4.0.0 to before 4.2.11Vulnerablecodeigniter4
  • cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.2.11 Vulnerable ·codeigniter4

Remediation

  • Fix · CNA CodeIgniter4 (codeigniter4) Fixed in 4.2.11
  • Fix · GHSA-6cq5-8cj7-g558 codeigniter4/framework (Packagist) Fixed in 4.2.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46170
  2. 2026-10-03 Alias added: GHSA-6cq5-8cj7-g558

References

Patch 1

Advisory 2

Other 3

  • TI-2014-07135 CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it… CVSS 3.0CRITICAL 9.8
  • TI-2022-16370 SameSite may allow cross-site request forgery (CSRF) protection to be bypassed CVSS 3.1HIGH 8.8
  • TI-2022-06025 Deserialization of Untrusted Data in Codeigniter4 CVSS 3.1CRITICAL 9.8
  • TI-2024-27591 A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily… CVSS 3.1HIGH 7.5
  • TI-2014-07136 CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by… CVSS 3.0CRITICAL 9.8
  • TI-2024-19671 CodeIgniter4 Language class DoS Vulnerability CVSS 3.1HIGH 7.5
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences