GHSA-r3hf-q3mf-7h6w

Suggest an improvement
Source
https://github.com/advisories/GHSA-r3hf-q3mf-7h6w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r3hf-q3mf-7h6w/GHSA-r3hf-q3mf-7h6w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r3hf-q3mf-7h6w
Aliases
Published
2026-03-23T15:30:44Z
Modified
2026-03-27T18:11:29Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client
Details

A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handler. The manipulation of the argument curlOptions results in improper certificate validation. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids":  [
        "CWE-287"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-27T17:53:22Z",
    "nvd_published_at":  "2026-03-23T13:16:31Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / hybridauth/hybridauth

Package

Name
hybridauth/hybridauth
Purl
pkg:composer/hybridauth/hybridauth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
3.12.2

Affected versions

v2.*
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.8.1
v2.8.2
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.15.1
v2.16.0
v2.17.0
v2.18.0
2.*
2.5.1
v3.*
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.0-beta.3
v3.0.0-beta.4
v3.0.0-rc.1
v3.0.0-rc.2
v3.0.0-rc.3
v3.0.0-rc.4
v3.0.0-rc.5
v3.0.0-rc.6
v3.0.0-rc.7
v3.0.0-rc.8
v3.0.0-rc.9
v3.0.0-rc.10
v3.0.0-rc.11
v3.0.0
v3.1.0
v3.1.1
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v3.10.0
v3.11.0
v3.12.0
v3.12.1
v3.12.2
3.*
3.2.0
3.3.0
3.4.0
3.5.0
3.6.0
3.7.0
3.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r3hf-q3mf-7h6w/GHSA-r3hf-q3mf-7h6w.json"