zfr authentication adapter did not verify validity of tokens

2024-06-0722:30:03

Google

osv.dev

zfr

authentication

adapter

token

validity

expiration

security

issue

software

7.4 High

AI Score

Confidence

Low

JSON

Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a (release 0.1.2), tokens weren’t checked for validity/expiration.

This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials.

CPENameOperatorVersion
zfr/zfr-oauth2-server-moduleeq0.1.0
zfr/zfr-oauth2-server-moduleeq0.1.1

CPE	Name	Operator	Version
	zfr/zfr-oauth2-server-module	eq	0.1.0
	zfr/zfr-oauth2-server-module	eq	0.1.1

References

github.com/FriendsOfPHP/security-advisories/blob/master/zfr/zfr-oauth2-server-module/2014-04-26.yaml

github.com/zf-fr/zfr-oauth2-server-module

github.com/zf-fr/zfr-oauth2-server-module/commit/2ca5bb1c2f11537be8f94ca6867d8d69789e744a

github.com/zf-fr/zfr-oauth2-server-module/issues/6

github.com/zf-fr/zfr-oauth2-server-module/tree/0.1.2

7.4 High

AI Score

Confidence

Low

JSON