CVE-2025-48493: Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-05 · updated 2026-06-17
Weakness: CWE-532

Description

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.

Affected products

yiisoft yii2-redis: before 2.0.20 — fixed in 2.0.20

How to fix

Upgrade to a fixed version: yiisoft yii2-redis 2.0.20. Check the vendor advisory for mitigations.

References

https://github.com/yiisoft/yii2-redis/commit/962252d2c57c187181e67bb66da3f27b4698358d
https://github.com/yiisoft/yii2-redis/security/advisories/GHSA-g3p6-82vc-43jh

Get alerted when CVE-2025-48493 or the next vulnerability affects your stack