Riskcovery

CVE-2023-0567

password_verify() always returns true for some invalid hashes

State
Published
Severity
7.7 High
Published
Feb 16, 2023
Updated
Jul 19, 2026
Reserved
Jan 29, 2023

Read the record on cve.org

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nphp
3.18.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCISA-ADP

Weaknesses

  • CWE-916 Use of Password Hash With Insufficient Computational Effort

Affected Products

ProductVersions
PHPPHP Group
  • 8.0.* to before 8.0.28Affected
  • 8.1.* to before 8.1.16Affected
  • 8.2.* to before 8.2.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.