CVE-2023-27580

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.

• CWE-916

• https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.htmlThird Party Advisory
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwordsNot Applicable
• https://github.com/codeigniter4/shield/blob/develop/UPGRADING.mdVendor Advisory
• https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0bPatch
• https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vgVendor Advisory
• https://www.scottbrady91.com/authentication/beware-of-password-shuckingThird Party Advisory
• https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.htmlThird Party Advisory
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwordsNot Applicable
• https://github.com/codeigniter4/shield/blob/develop/UPGRADING.mdVendor Advisory
• https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0bPatch
• https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vgVendor Advisory
• https://www.scottbrady91.com/authentication/beware-of-password-shuckingThird Party Advisory

Published

Mar 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27574ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-tas…9.8
• CVE-2023-27576An issue was discovered in phpList before 3.6.14. Due to an …6.7
• CVE-2023-27577flarum is a forum software package for building communities.…4.9
• CVE-2023-27578Galaxy is an open-source platform for data analysis. All sup…7.5
• CVE-2023-27579TensorFlow is an end-to-end open source platform for machine…7.5
• CVE-2023-2758A denial of service vulnerability exists in Contec CONPROSYS…5.3
• CVE-2023-27581github-slug-action is a GitHub Action to expose slug value o…8.8
• CVE-2023-27582maddy is a composable, all-in-one mail server. Starting with…9.8
• CVE-2023-27583PanIndex is a network disk directory index. In Panindex prio…9.8
• CVE-2023-27584Dragonfly is an open source P2P-based file distribution and …9.8
• CVE-2023-27585PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2023-27586CairoSVG is an SVG converter based on Cairo, a 2D graphics l…7.1