CVE-2023-0567EPSS p59.8%

CVE-2023-0567CVE-2023-0567

php / php

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Scoring

CVSS 7.7 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.95% probability of exploitation · percentile 59.8% · 2026-10-05T12:00:23Z
Last modified2026-07-19
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.