CVE-2022-46170

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

• CWE-287

• https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328Patch, Third Party Advisory
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558Third Party Advisory
• https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328Patch, Third Party Advisory
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558Third Party Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46165Syncthing is an open source, continuous file synchronization…5.4
• CVE-2022-46166Spring boot admins is an open source administrative user int…9.8
• CVE-2022-46167Capsule is a multi-tenancy and policy-based framework for Ku…8.8
• CVE-2022-46168Discourse is an option source discussion platform. Prior to …3.5
• CVE-2022-46169Cacti is an open source platform which provides a robust and…9.8
• CVE-2022-4617Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2022-46171Tauri is a framework for building binaries for all major des…7.7
• CVE-2022-46172authentik is an open-source Identity provider focused on fle…6.4
• CVE-2022-46173Elrond-GO is a go implementation for the Elrond Network prot…6.5
• CVE-2022-46174efs-utils is a set of Utilities for Amazon Elastic File Syst…4.2
• CVE-2022-46175JSON5 is an extension to the popular JSON file format that a…8.8
• CVE-2022-46176Cargo is a Rust package manager. The Rust Security Response …5.9