{"id":"GHSA-hhw9-35p2-q2c5","aliases":[],"title":"Steam Socialite Provider v1 does not correctly validate openid server","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"### Impact\nThe outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.\n\n### Patches\nThis vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)\n* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)","severity":"critical","score":null,"published":"2021-01-29T20:51:30.000Z","modified":"2024-12-02T05:44:34.357Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"socialiteproviders/steam","sources":[{"name":"OSV · GHSA-hhw9-35p2-q2c5","url":"https://osv.dev/vulnerability/GHSA-hhw9-35p2-q2c5"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0"}],"type":"ECOSYSTEM"}],"versions":["v1.0.0","v1.0.1","v1.1"],"fixed":["3.0"]}],"sourceAffected":[],"references":["https://github.com/SocialiteProviders/Steam/security/advisories/GHSA-hhw9-35p2-q2c5","https://packagist.org/packages/socialiteproviders/steam"],"sources":[{"name":"OSV","id":"GHSA-hhw9-35p2-q2c5","modified":"2024-12-02T05:44:34.357512Z","url":"https://osv.dev/vulnerability/GHSA-hhw9-35p2-q2c5"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-29T01:45:31.656Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}