{"id":"GHSA-v427-c49j-8w6x","aliases":["CVE-2023-48707"],"title":"Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n**secretKey**, an important key for HMAC SHA256 authentication, was stored in the database in raw form.\n\nIf a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that person.\n\n### Patches\nUpgrade to Shield v1.0.0-beta.8 or later.\n\nAfter upgrading, all existing secret keys must be encrypted.\nSee https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.\n\n### Workarounds\nNone.\n\n### References\n- https://codeigniter4.github.io/shield/references/authentication/hmac/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)\n","severity":"medium","score":5,"published":"2023-11-23T00:28:14.000Z","modified":"2026-09-10T03:49:59.131Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"codeigniter4/shield","sources":[{"name":"OSV · GHSA-v427-c49j-8w6x","url":"https://osv.dev/vulnerability/GHSA-v427-c49j-8w6x"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.0-beta.8"}],"type":"ECOSYSTEM"}],"versions":["v1.0.0-beta","v1.0.0-beta.2","v1.0.0-beta.3","v1.0.0-beta.4","v1.0.0-beta.5","v1.0.0-beta.6","v1.0.0-beta.7"],"fixed":["1.0.0-beta.8"]}],"sourceAffected":[],"references":["https://github.com/codeigniter4/shield/security/advisories/GHSA-v427-c49j-8w6x","https://nvd.nist.gov/vuln/detail/CVE-2023-48707","https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f","https://github.com/codeigniter4/shield"],"sources":[{"name":"OSV","id":"GHSA-v427-c49j-8w6x","modified":"2026-09-10T03:49:59.131615068Z","url":"https://osv.dev/vulnerability/GHSA-v427-c49j-8w6x"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","score":5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:40:30.803Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}