CVE-2026-4587 - HybridAuth SSL Curl.php certificate validation

Back Back to CVE browser

MEDIUM

HybridAuth SSL Curl.php certificate validation

Published Mar 23, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.26%

Description

A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handler. The manipulation of the argument curlOptions results in improper certificate validation. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor n/a Product HybridAuth Default
n/a
- Version
  3.12.0
  Status
  affected
  Constraints
  -
- Version
  3.12.1
  Status
  affected
  Constraints
  -
- Version
  3.12.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

HybridAuth

n/a

Version	Status	Constraints
3.12.0	affected	-
3.12.1	affected	-
3.12.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-295

Improper Certificate Validation

References (8)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14425
Advisory
https://github.com/advisories/GHSA-r3hf-q3mf-7h6w
Advisory
https://github.com/hybridauth/hybridauth/
product
https://github.com/hybridauth/hybridauth/issues/1444
issue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-4587
https://vuldb.com/?ctiid.352423
signaturepermissions-required
https://vuldb.com/?id.352423
vdb-entrytechnical-description
https://vuldb.com/?submit.775463
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14425		Advisory
https://github.com/advisories/GHSA-r3hf-q3mf-7h6w		Advisory
https://github.com/hybridauth/hybridauth/		product
https://github.com/hybridauth/hybridauth/issues/1444		issue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-4587
https://vuldb.com/?ctiid.352423		signaturepermissions-required
https://vuldb.com/?id.352423		vdb-entrytechnical-description
https://vuldb.com/?submit.775463		third-party-advisory