{"id":"CVE-2023-48708","aliases":["GHSA-j72f-h752-mx4w"],"url":"https://o3.security/vulnerability/CVE-2023-48708","summary":"Insertion of Sensitive Information into Log in codeigniter4/shield","details":"### Impact\nIf successful login attempts are recorded, the raw tokens are stored in the log table.\nIf a malicious person somehow views the data in the log table, he or she can obtain a raw token, which can then be used to send a request with that user's authority.\n\nWhen you (1) **use the following authentiactors**,\n- [AccessTokens](https://codeigniter4.github.io/shield/references/authentication/tokens/) (`tokens`)\n- [JWT](https://codeigniter4.github.io/shield/addons/jwt/) (`jwt`)\n- [HmacSha256](https://codeigniter4.github.io/shield/references/authentication/hmac/) (`hmac`)\n\nand you (2) **log successful login attempts**, the raw tokens are stored.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.8 or later.\n\n### Workarounds\nDisable logging for successful login attempts by the configuration files.\n\n- AccessTokens or HmacSha256\n   - Set `Config\\AuthToken::$recordLoginAttempt` to `Auth::RECORD_LOGIN_ATTEMPT_FAILURE` or `Auth::RECORD_LOGIN_ATTEMPT_NONE`\n- JWT\n   - Set `Config\\AuthJWT::$recordLoginAttempt` to `Auth::RECORD_LOGIN_ATTEMPT_FAILURE` or `Auth::RECORD_LOGIN_ATTEMPT_NONE`\n\n### References\n- https://codeigniter4.github.io/shield/getting_started/authenticators/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","published":"2023-11-24T17:16:15.732Z","modified":"2026-08-12T03:51:12.391272890Z","cvss":{"score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"codeigniter4/shield","fixedVersion":"1.0.0-beta.8"}],"fix":{"url":"https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4","label":"codeigniter4/shield@7e84c3f"},"references":[{"type":"WEB","url":"https://codeigniter4.github.io/shield/getting_started/authenticators/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48708.json"},{"type":"ADVISORY","url":"https://github.com/codeigniter4/shield/security/advisories/GHSA-j72f-h752-mx4w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48708"},{"type":"FIX","url":"https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4"},{"type":"WEB","url":"https://codeigniter4.github.io/shield/getting_started/authenticators"},{"type":"PACKAGE","url":"https://github.com/codeigniter4/shield"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.391272890Z"}}