{"cve":"CVE-2023-37260","nvd":{"published":"2023-07-06T16:15:10.303","modified":"2026-06-17T06:07:50.160","status":"Modified","description":"league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-209"],"references":["https://github.com/thephpleague/oauth2-server/pull/1353","https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3","https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm","https://github.com/thephpleague/oauth2-server/pull/1353","https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3"],"products":["thephpleague:oauth2-server"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-37260","score":0.00951,"percentile":0.61284,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}