{"id":"CVE-2023-48707","aliases":["GHSA-v427-c49j-8w6x"],"url":"https://o3.security/vulnerability/CVE-2023-48707","summary":"Cleartext Storage of Sensitive Information in codeigniter4/shield","details":"### Impact\n**secretKey**, an important key for HMAC SHA256 authentication, was stored in the database in raw form.\n\nIf a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.8 or later.\n\nAfter upgrading, all existing secret keys must be encrypted.\nSee https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.\n\n### Workarounds\nNone.\n\n### References\n- https://codeigniter4.github.io/shield/references/authentication/hmac/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","published":"2023-11-24T17:23:34.798Z","modified":"2026-08-12T03:51:35.667780877Z","cvss":{"score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"},"epss":{"score":0.00284,"percentile":0.20448,"asOf":"2026-08-31"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"codeigniter4/shield","fixedVersion":"1.0.0-beta.8"}],"fix":{"url":"https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f","label":"codeigniter4/shield@f77c6ae"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48707.json"},{"type":"ADVISORY","url":"https://github.com/codeigniter4/shield/security/advisories/GHSA-v427-c49j-8w6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48707"},{"type":"FIX","url":"https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f"},{"type":"PACKAGE","url":"https://github.com/codeigniter4/shield"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:35.667780877Z"}}