CVE-2013-4701

The CVE-2013-4701 issue affects the PHP OpenID Library up to version 2.2.2 and earlier, where Auth/Yadis/XML.php processes XRDS data containing an external entity declaration. This XXE flaw enables a remote attacker to read arbitrary files, make HTTP requests to internal/intranet hosts, or trigge...

CVE-2016-2049

The CVE-2016-2049 entry describes a vulnerability in the JanRain PHP OpenID library (php-openid), where examples/consumer/common.php improperly compares the openid.realm parameter to the SERVER_NAME value from the SERVER superglobal. This mismatch can allow remote attackers to hijack user authent...

CVE-2011-3707

The CVE-2011-3707 issue affects the JanRain PHP OpenID library (php-openid) 2.2.2. Affected component/file access allows remote attackers to obtain sensitive information by directly requesting certain PHP files (e.g., Auth/Yadis/Yadis.php), revealing the installation path through an error message...