Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rn23-tab5-3kbq
Vulnerability ID VCID-rn23-tab5-3kbq
Aliases CVE-2023-27580
GHSA-c5vj-f36q-p9vg
Summary Use of Password Hash With Insufficient Computational Effort CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-916 Use of Password Hash With Insufficient Computational Effort
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2023-27580
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2023-27580
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2023-27580
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2023-27580
cvssv3.1 5.9 https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
cvssv3.1 7.5 https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
generic_textual MODERATE https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
ssvc Track https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
cvssv3.1 5.9 https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
cvssv3.1 7.5 https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
generic_textual MODERATE https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
ssvc Track https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-c5vj-f36q-p9vg
cvssv3.1 5.9 https://github.com/codeigniter4/shield
generic_textual MODERATE https://github.com/codeigniter4/shield
cvssv3.1 5.9 https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
cvssv3.1 7.5 https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
generic_textual MODERATE https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
ssvc Track https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
cvssv3.1 5.9 https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
cvssv3.1 7.5 https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
generic_textual MODERATE https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
ssvc Track https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
cvssv3.1 5.9 https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
cvssv3.1 7.5 https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
cvssv3.1_qr MODERATE https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
generic_textual MODERATE https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
ssvc Track https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2023-27580
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-27580
cvssv3.1 5.9 https://www.scottbrady91.com/authentication/beware-of-password-shucking
cvssv3.1 7.5 https://www.scottbrady91.com/authentication/beware-of-password-shucking
generic_textual MODERATE https://www.scottbrady91.com/authentication/beware-of-password-shucking
ssvc Track https://www.scottbrady91.com/authentication/beware-of-password-shucking
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-27580
https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
https://github.com/codeigniter4/shield
https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
https://www.scottbrady91.com/authentication/beware-of-password-shucking
CVE-2023-27580 https://nvd.nist.gov/vuln/detail/CVE-2023-27580
GHSA-c5vj-f36q-p9vg https://github.com/advisories/GHSA-c5vj-f36q-p9vg
GHSA-c5vj-f36q-p9vg https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:31:16Z/ Found at https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:31:16Z/ Found at https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:31:16Z/ Found at https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:31:16Z/ Found at https://github.com/codeigniter4/shield/commit/ea9688dd01d100193d834117dbfc2cfabcf9ea0b
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:31:16Z/ Found at https://github.com/codeigniter4/shield/security/advisories/GHSA-c5vj-f36q-p9vg
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-27580
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.scottbrady91.com/authentication/beware-of-password-shucking
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.scottbrady91.com/authentication/beware-of-password-shucking
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:31:16Z/ Found at https://www.scottbrady91.com/authentication/beware-of-password-shucking
Exploit Prediction Scoring System (EPSS)
Percentile 0.39755
EPSS Score 0.00182
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:44:14.861893+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/codeigniter4/shield/CVE-2023-27580.yml 38.6.0