zfr authentication adapter did not verify validity of tokens
Priority LOW 38CWE-613Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-613.
Summary
Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a (release [0.1.2](https://github.com/zf-fr/zfr-oauth2-server-module/tree/0.1.2)), tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials.
Why it matters now
Fix Fixed zfr/zfr-oauth2-server-module (Packagist): 0.1.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zfr/zfr-oauth2-server-module (Packagist) | before 0.1.2 | 0.1.2 | Patch available | GHSA-rcm4-jv5g-wccm |
- zfr/zfr-oauth2-server-module (Packagist) Vendor— Affected before 0.1.2 Fixed in 0.1.2 Patch available GHSA-rcm4-jv5g-wccm
Remediation
- Fix · GHSA-rcm4-jv5g-wccm zfr/zfr-oauth2-server-module (Packagist) Fixed in 0.1.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-rcm4-jv5g-wccm
References
Other 5
- https://github.com/zf-fr/zfr-oauth2-server-module/issues/6
- https://github.com/zf-fr/zfr-oauth2-server-module/commit/2ca5bb1c2f11537be8f94ca6867d8d69789e744a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zfr/zfr-oauth2-server-module/2014-04-26.yaml
- https://github.com/zf-fr/zfr-oauth2-server-module
- https://github.com/zf-fr/zfr-oauth2-server-module/tree/0.1.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences