{"id":4339351,"name":"codeigniter4/shield","ecosystem":"packagist","description":"Authentication and Authorization for CodeIgniter 4","homepage":"https://github.com/codeigniter4/shield","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/codeigniter4/shield","keywords_array":["authorization","Authentication","codeigniter","codeigniter4"],"namespace":"codeigniter4","versions_count":17,"first_release_published_at":"2022-06-03T03:40:05.000Z","latest_release_published_at":"2026-08-18T12:02:04.000Z","latest_release_number":"v1.4.1","last_synced_at":"2026-09-26T20:16:35.421Z","created_at":"2022-04-28T04:11:08.563Z","updated_at":"2026-09-27T17:19:42.626Z","registry_url":"https://packagist.org/packages/codeigniter4/shield#","install_command":"composer require codeigniter4/shield","documentation_url":null,"metadata":{"funding":[]},"repo_metadata":{"id":37860812,"uuid":"325478523","full_name":"codeigniter4/shield","owner":"codeigniter4","description":"Authentication and Authorization for CodeIgniter 4","archived":false,"fork":false,"pushed_at":"2026-09-04T10:47:43.000Z","size":11855,"stargazers_count":426,"open_issues_count":18,"forks_count":143,"subscribers_count":32,"default_branch":"develop","last_synced_at":"2026-09-20T18:36:55.155Z","etag":null,"topics":["auth","authentication","authorization","codeigniter4"],"latest_commit_sha":null,"homepage":"https://shield.codeigniter.com","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/codeigniter4.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2020-12-30T06:55:29.000Z","updated_at":"2026-09-18T22:11:05.000Z","dependencies_parsed_at":"2024-01-19T04:28:09.967Z","dependency_job_id":"6618f2e1-d2af-480d-8045-d722b65acc09","html_url":"https://github.com/codeigniter4/shield","commit_stats":{"total_commits":2113,"total_committers":80,"mean_commits":26.4125,"dds":0.4813061997160435,"last_synced_commit":"ee779a08c0dfcda12d488e6174fa559d17983e41"},"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"purl":"pkg:github/codeigniter4/shield","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codeigniter4","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37573108,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-21T02:00:06.232Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"codeigniter4","name":"CodeIgniter 4 web framework","uuid":"44521256","kind":"organization","description":"","email":"admin@codeigniter.com","website":"https://codeigniter.com","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/44521256?v=4","repositories_count":16,"last_synced_at":"2024-03-25T20:21:10.739Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/codeigniter4","funding_links":[],"total_stars":6415,"followers":413,"following":0,"created_at":"2022-11-02T16:30:22.013Z","updated_at":"2024-03-25T20:21:21.196Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codeigniter4","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codeigniter4/repositories"},"tags":[{"name":"v1.2.0","sha":"2d1b2177a914dcd490f54a6706792eacabd9e3e8","kind":"commit","published_at":"2025-07-14T10:26:03.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.2.0","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.2.0/manifests"},{"name":"v1.1.0","sha":"22a8b3b58dafa7a5c080bc61446653aeb9fffc06","kind":"commit","published_at":"2024-06-13T08:54:48.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.1.0","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.1.0/manifests"},{"name":"v1.0.3","sha":"3fbac7a3da41ebaac7d51708244f68df596409f0","kind":"commit","published_at":"2024-04-14T08:57:57.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.3","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.3/manifests"},{"name":"v1.0.2","sha":"0b1cab53ea89b37464f72ad075b9b287c0cc0f5e","kind":"commit","published_at":"2024-03-17T04:00:12.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.2","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.2/manifests"},{"name":"v1.0.1","sha":"d97aa5fba44971d1916bbbee79bef3804ab5e111","kind":"commit","published_at":"2024-02-15T04:03:19.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.1","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"7be6b60250158ade521a6f0fdb15ece02254d09a","kind":"commit","published_at":"2023-12-27T06:55:58.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0/manifests"},{"name":"v1.0.0-beta.8","sha":"434e5a0e550d24199dc4f04033a872e8d3d847d7","kind":"commit","published_at":"2023-11-22T23:56:12.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.8","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.8/manifests"},{"name":"v1.0.0-beta.7","sha":"5e4ebadefa66b5af77794c633bfa44fa3be09b73","kind":"commit","published_at":"2023-10-09T05:42:13.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.7","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.7/manifests"},{"name":"v1.0.0-beta.6","sha":"b5fbc784e8ab6ee8e9de103e62b15f8248c05a9f","kind":"commit","published_at":"2023-04-26T08:31:55.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.6","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.6/manifests"},{"name":"v1.0.0-beta.5","sha":"062d66b1570fea14b22dc3dae6414d64879eb519","kind":"commit","published_at":"2023-03-18T08:49:30.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.5","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.5/manifests"},{"name":"v1.0.0-beta.4","sha":"ea9688dd01d100193d834117dbfc2cfabcf9ea0b","kind":"commit","published_at":"2023-03-11T05:01:18.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.4","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.4/manifests"},{"name":"v1.0.0-beta.3","sha":"5e6d5175da45b06dbe7d1deda03458d79d45a951","kind":"commit","published_at":"2022-10-30T23:14:47.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.3","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.3/manifests"},{"name":"v1.0.0-beta.2","sha":"342a368536678621998c3c41d276480cd14ec6c6","kind":"commit","published_at":"2022-08-07T15:20:07.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta.2","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta.2/manifests"},{"name":"v1.0.0-beta","sha":"c66012f887d9e9ab14183472b162114f48ad4561","kind":"commit","published_at":"2022-06-03T03:40:05.000Z","download_url":"https://codeload.github.com/codeigniter4/shield/tar.gz/v1.0.0-beta","html_url":"https://github.com/codeigniter4/shield/releases/tag/v1.0.0-beta","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/codeigniter4/shield@v1.0.0-beta","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/tags/v1.0.0-beta/manifests"}]},"repo_metadata_updated_at":"2026-09-26T20:16:36.258Z","dependent_packages_count":10,"downloads":549595,"downloads_period":"total","dependent_repos_count":35,"rankings":{"downloads":4.187037138762241,"dependent_repos_count":1.7390848393749783,"dependent_packages_count":2.35937156668864,"stargazers_count":0.8730287555094958,"forks_count":0.5403272925208116,"docker_downloads_count":0.5862700937333021,"average":1.714186614431578},"purl":"pkg:composer/codeigniter4/shield","advisories":[{"uuid":"GSA_kwCzR0hTQS12NDI3LWM0OWotOHc2eM4AA3VI","url":"https://github.com/advisories/GHSA-v427-c49j-8w6x","title":"Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication","description":"### Impact\n**secretKey**, an important key for HMAC SHA256 authentication, was stored in the database in raw form.\n\nIf a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.8 or later.\n\nAfter upgrading, all existing secret keys must be encrypted.\nSee https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.\n\n### Workarounds\nNone.\n\n### References\n- https://codeigniter4.github.io/shield/references/authentication/hmac/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-11-23T00:28:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/codeigniter4/shield/security/advisories/GHSA-v427-c49j-8w6x","https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f","https://nvd.nist.gov/vuln/detail/CVE-2023-48707","https://github.com/advisories/GHSA-v427-c49j-8w6x"],"source_kind":"github","identifiers":["GHSA-v427-c49j-8w6x","CVE-2023-48707"],"repository_url":"https://github.com/codeigniter4/shield","blast_radius":0.0,"created_at":"2023-11-23T01:06:00.043Z","updated_at":"2026-09-27T17:10:33.500Z","epss_percentage":0.00284,"epss_percentile":0.18546,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NDI3LWM0OWotOHc2eM4AA3VI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NDI3LWM0OWotOHc2eM4AA3VI","packages":[{"ecosystem":"packagist","package_name":"codeigniter4/shield","versions":[{"first_patched_version":"1.0.0-beta.8","vulnerable_version_range":"\u003c 1.0.0-beta.8"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NDI3LWM0OWotOHc2eM4AA3VI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qNzJmLWg3NTItbXg0d84AA3VH","url":"https://github.com/advisories/GHSA-j72f-h752-mx4w","title":"Insertion of Sensitive Information into Log","description":"### Impact\nIf successful login attempts are recorded, the raw tokens are stored in the log table.\nIf a malicious person somehow views the data in the log table, he or she can obtain a raw token, which can then be used to send a request with that user's authority.\n\nWhen you (1) **use the following authentiactors**,\n- [AccessTokens](https://codeigniter4.github.io/shield/references/authentication/tokens/) (`tokens`)\n- [JWT](https://codeigniter4.github.io/shield/addons/jwt/) (`jwt`)\n- [HmacSha256](https://codeigniter4.github.io/shield/references/authentication/hmac/) (`hmac`)\n\nand you (2) **log successful login attempts**, the raw tokens are stored.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.8 or later.\n\n### Workarounds\nDisable logging for successful login attempts by the configuration files.\n\n- AccessTokens or HmacSha256\n   - Set `Config\\AuthToken::$recordLoginAttempt` to `Auth::RECORD_LOGIN_ATTEMPT_FAILURE` or `Auth::RECORD_LOGIN_ATTEMPT_NONE`\n- JWT\n   - Set `Config\\AuthJWT::$recordLoginAttempt` to `Auth::RECORD_LOGIN_ATTEMPT_FAILURE` or `Auth::RECORD_LOGIN_ATTEMPT_NONE`\n\n### References\n- https://codeigniter4.github.io/shield/getting_started/authenticators/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-11-23T00:28:13.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.0,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/codeigniter4/shield/security/advisories/GHSA-j72f-h752-mx4w","https://github.com/codeigniter4/shield/commit/7e84c3fb3411294f70890819bfe51781bb9dc8e4","https://nvd.nist.gov/vuln/detail/CVE-2023-48708","https://codeigniter4.github.io/shield/getting_started/authenticators/","https://github.com/advisories/GHSA-j72f-h752-mx4w"],"source_kind":"github","identifiers":["GHSA-j72f-h752-mx4w","CVE-2023-48708"],"repository_url":"https://github.com/codeigniter4/shield","blast_radius":0.0,"created_at":"2023-11-23T01:06:00.065Z","updated_at":"2026-09-27T17:10:33.500Z","epss_percentage":0.0063,"epss_percentile":0.47938,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNzJmLWg3NTItbXg0d84AA3VH","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qNzJmLWg3NTItbXg0d84AA3VH","packages":[{"ecosystem":"packagist","package_name":"codeigniter4/shield","versions":[{"first_patched_version":"1.0.0-beta.8","vulnerable_version_range":"\u003c 1.0.0-beta.8"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNzJmLWg3NTItbXg0d84AA3VH/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jNXZqLWYzNnEtcDl2Z84AAyEz","url":"https://github.com/advisories/GHSA-c5vj-f36q-p9vg","title":"Password Shucking Vulnerability","description":"### Impact\nAn improper implementation was found in the password storage process.\n\nAll hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible.\n\nIf an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.4 or later.\n\nAfter upgrading, all users’ hashed passwords should be updated (saved to the database).\nSee https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.\n\n### Workarounds\nNone.\n\n### References\n- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords\n- https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html\n- https://www.scottbrady91.com/authentication/beware-of-password-shucking\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-03-13T20:51:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg","https://nvd.nist.gov/vuln/detail/CVE-2023-27580","https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b","https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html","https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords","https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md","https://www.scottbrady91.com/authentication/beware-of-password-shucking","https://github.com/advisories/GHSA-c5vj-f36q-p9vg"],"source_kind":"github","identifiers":["GHSA-c5vj-f36q-p9vg","CVE-2023-27580"],"repository_url":"https://github.com/codeigniter4/shield","blast_radius":0.0,"created_at":"2023-03-13T21:03:14.473Z","updated_at":"2026-09-27T17:12:31.822Z","epss_percentage":0.00517,"epss_percentile":0.41513,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNXZqLWYzNnEtcDl2Z84AAyEz","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jNXZqLWYzNnEtcDl2Z84AAyEz","packages":[{"ecosystem":"packagist","package_name":"codeigniter4/shield","versions":[{"first_patched_version":"1.0.0-beta.4","vulnerable_version_range":"\u003c 1.0.0-beta.4"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNXZqLWYzNnEtcDl2Z84AAyEz/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01aG04LXZoNnItMmNqcc4AAuFp","url":"https://github.com/advisories/GHSA-5hm8-vh6r-2cjq","title":"CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection","description":"### Impact\nThis vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield.\n\nFor this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`).\n\nThis vulnerability exists whether `Config\\Security::$csrfProtection` is `'cookie'` or `'session'`.\nIt is also exploitable whether `Config\\Security::$regenerate` is `true` or `false`.\n\n### Patches\nUpgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**.\n\n### Workarounds\nDo all of the following:\n- set `Config\\Security::$csrfProtection` to `'session'`\n- remove old session data right after login (immediately after ID and password match)\n- regenerate CSRF token right after login (immediately after ID and password match)\n\n### References\n- [CodeIgniter4 CSRF Protection](https://codeigniter4.github.io/userguide/libraries/security.html)\n- [SameSite Attacks](https://canitakeyoursubdomain.name/)\n- [SameSite Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n- [The great SameSite confusion](https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-08-18T19:03:34.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L","references":["https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq","https://nvd.nist.gov/vuln/detail/CVE-2022-35943","https://github.com/codeigniter4/shield/commit/342a368536678621998c3c41d276480cd14ec6c6","https://codeigniter4.github.io/userguide/libraries/security.htm","https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite","https://jub0bs.com/posts/2021-01-29-great-samesite-confusion","https://github.com/advisories/GHSA-5hm8-vh6r-2cjq"],"source_kind":"github","identifiers":["GHSA-5hm8-vh6r-2cjq","CVE-2022-35943"],"repository_url":"https://github.com/codeigniter4/shield","blast_radius":0.0,"created_at":"2022-12-21T16:12:00.982Z","updated_at":"2026-09-27T17:13:29.086Z","epss_percentage":0.00581,"epss_percentile":0.45528,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01aG04LXZoNnItMmNqcc4AAuFp","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01aG04LXZoNnItMmNqcc4AAuFp","packages":[{"ecosystem":"packagist","package_name":"codeigniter4/shield","versions":[{"first_patched_version":"1.0.0-beta.2","vulnerable_version_range":"= 1.0.0-beta"}],"purl":null,"statistics":{"dependent_packages_count":10,"dependent_repos_count":35,"downloads":548501,"downloads_period":"total"},"affected_versions":["v1.0.0-beta"],"unaffected_versions":["v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.1.0","v1.2.0","v1.3.0","v1.4.0","v1.4.1"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01aG04LXZoNnItMmNqcc4AAuFp/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/packagist/codeigniter4/shield","docker_dependents_count":1,"docker_downloads_count":1927,"usage_url":"https://repos.ecosyste.ms/usage/packagist/codeigniter4/shield","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/packagist/codeigniter4/shield/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-25T19:17:15.112Z","issues_count":89,"pull_requests_count":569,"avg_time_to_close_issue":5390634.605263158,"avg_time_to_close_pull_request":749235.6704980843,"issues_closed_count":76,"pull_requests_closed_count":522,"pull_request_authors_count":69,"issue_authors_count":57,"avg_comments_per_issue":2.764044943820225,"avg_comments_per_pull_request":1.6186291739894552,"merged_pull_requests_count":446,"bot_issues_count":0,"bot_pull_requests_count":91,"past_year_issues_count":3,"past_year_pull_requests_count":55,"past_year_avg_time_to_close_issue":9292346.333333334,"past_year_avg_time_to_close_pull_request":596088.2452830189,"past_year_issues_closed_count":3,"past_year_pull_requests_closed_count":53,"past_year_pull_request_authors_count":8,"past_year_issue_authors_count":3,"past_year_avg_comments_per_issue":3.0,"past_year_avg_comments_per_pull_request":1.4727272727272727,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":24,"past_year_merged_pull_requests_count":50,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/codeigniter4%2Fshield/issues","maintainers":[{"login":"kenjis","count":160,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/kenjis"},{"login":"datamweb","count":114,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/datamweb"},{"login":"michalsn","count":27,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/michalsn"},{"login":"samsonasik","count":11,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/samsonasik"},{"login":"paulbalandan","count":11,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/paulbalandan"},{"login":"lonnieezell","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/lonnieezell"}],"active_maintainers":[{"login":"michalsn","count":12,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/michalsn"},{"login":"samsonasik","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/samsonasik"},{"login":"datamweb","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/datamweb"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/codeigniter4%2Fshield/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/codeigniter4%2Fshield/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/codeigniter4%2Fshield/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/codeigniter4%2Fshield/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/codeigniter4%2Fshield/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/packages/codeigniter4%2Fshield/codemeta","maintainers":[{"uuid":"lonnieezell","login":"lonnieezell","name":null,"email":null,"url":null,"packages_count":30,"html_url":"https://packagist.org/users/lonnieezell","role":null,"created_at":"2022-11-17T21:50:11.287Z","updated_at":"2022-11-17T21:50:11.287Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/packagist.org/maintainers/lonnieezell/packages"}]}