UpHeron
All vulnerabilities

Servers and applications

CVE-2023-35941

OAuth2 credentials exploit with permanent validity

Severity
Critical 9.8
Published
25 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.23.12, 1.24.10, 1.25.9, 1.26.4
Also known as
GHSA-7mhv-gr67-hq55
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9,…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.23.0 before 1.23.12
  • From 1.24.0 before 1.24.10
  • From 1.25.0 before 1.25.9
  • From 1.26.0 before 1.26.4
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.23.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-35941
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-35941
  • GitHub Advisory Database https://github.com/advisories/GHSA-7mhv-gr67-hq55
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55