CVE-2025-24373: Conditional Hash Equals Auth Bypass
A sensitive authentication or authorization validation (e.g. `hash_equals()`) is conditionally omitted if a specific array key or variable is set. By failing to perform an equivalent strong security validation (such as a nonce or role validation) when the parameter is present, an attacker can force the code branch entirely bypassing access controls simply by
PHPβgreprules fetch cve-2025-24373-conditional-hash-equals-auth-bypass --engine opengrepDescription
A sensitive authentication or authorization validation (e.g. `hash_equals()`) is conditionally omitted if a specific array key or variable is set. By failing to perform an equivalent strong security validation (such as a nonce or role validation) when the parameter is present, an attacker can force the code branch entirely bypassing access controls simply by
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0