CVE-2026-4587: HybridAuth SSL Curl.php certificate validation

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-23 · updated 2026-06-17
Weakness: CWE-287

Description

A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handler. The manipulation of the argument curlOptions results in improper certificate validation. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

HybridAuth: 3.12.0, 3.12.1, 3.12.2

References

https://github.com/hybridauth/hybridauth/
https://github.com/hybridauth/hybridauth/issues/1444
https://vuldb.com/?ctiid.352423
https://vuldb.com/?id.352423
https://vuldb.com/?submit.775463

Get alerted when CVE-2026-4587 or the next vulnerability affects your stack