CVE-2014-8684: CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attac...

Security readout for executives and security teams

This issue affects older CodeIgniter and Kohana PHP applications. Weak hash comparison can let a remote attacker forge session cookies, which may lead to PHP object injection. Business impact depends on whether the application uses vulnerable framework session handling and whether dangerous objects are reachable. Exposure is most likely in legacy PHP web applications or products bundling affected CodeIgniter or Kohana versions with cookie-based sessions. The bundle does not identify all downstream products or configuration requirements. Prioritize remediation for internet-facing legacy PHP applications and appliances. The issue is old, but old framework code often remains embedded in business systems, and successful exploitation can affect account integrity or application control. Mitigation focus: Upgrade CodeIgniter applications to 3.0 or later where feasible.; Upgrade Kohana beyond the affected 3.2.3 and 3.3.2 ranges.; Review vendor guidance for applications or appliances bundling these frameworks..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.