Which versions of PHP are affected by CVE-2026-4587?

CVE-2026-4587 is a low-severity vulnerability in HybridAuth (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-4587?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

PHP CVE-2026-4587

Q: What is the CVSS score of CVE-2026-4587?

CVE-2026-4587 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14425 MEDIUM

Improper Certificate Validation (CWE-295)

2026-03-23 VulDB

GHSA-r3hf-q3mf-7h6w

PHP Information Disclosure

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 24, 2026 - 16:37 NVD

LOW MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

3.7 (LOW) 6.3 (MEDIUM)

EUVD ID Assigned

Mar 23, 2026 - 13:00 euvd

EUVD-2026-14425

Analysis Generated

Mar 23, 2026 - 13:00 vuln.today

CVE Published

Mar 23, 2026 - 12:46 nvd

LOW 3.7

DescriptionCVE.org

A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handler. The manipulation of the argument curlOptions results in improper certificate validation. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

HybridAuth versions up to 3.12.2 contain an improper certificate validation vulnerability in the SSL Handler component (src/HttpClient/Curl.php) where manipulation of curlOptions arguments bypasses SSL/TLS certificate verification. This affects any application using HybridAuth for authentication, allowing attackers to conduct man-in-the-middle attacks against remote authentication flows. While the CVSS score is relatively low (3.7) due to high attack complexity and lack of confidentiality impact, the integrity compromise from certificate validation bypass presents a real threat to authentication security in vulnerable deployments.

Technical ContextAI

HybridAuth is a PHP library for managing social authentication integrations. The vulnerability resides in the Curl.php HTTP client handler, which implements SSL/TLS connectivity for authenticating users via third-party providers. The root cause is classified under CWE-295 (Improper Certificate Validation), where the curl options configuration accepts user-controllable parameters that can disable or weaken certificate verification mechanisms. This allows attackers to inject malicious curl options (such as CURLOPT_SSL_VERIFYPEER or CURLOPT_SSL_VERIFYHOST) that suppress validation of the remote server's SSL certificate, enabling interception of authentication tokens and session data during OAuth/social login flows.

RemediationAI

Upgrade HybridAuth to a patched version greater than 3.12.2 immediately once released by the project team. Monitor the official HybridAuth GitHub repository (https://github.com/hybridauth/hybridauth/) and the reported issue (https://github.com/hybridauth/hybridauth/issues/1444) for patch availability. As an interim workaround, implement network-level controls to prevent man-in-the-middle attacks: enforce HTTPS with HSTS headers, pin SSL certificates for OAuth provider connections, and restrict outbound HTTPS traffic to known legitimate authentication endpoints. Code review any custom curl option configurations to ensure certificate validation is not being disabled. Additionally, enforce PHP configuration settings php_flag openssl.allow_self_signed to false if self-signed certificates are not required for legitimate authentication flows.