CVE-2023-0567

score

<0.1

cvss

7.7

epss

0.9%

published

2023-03-01

kev added

—

first seen

2026-10-21

PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16, and 8.2.X before 8.2.3 contain a password verification bypass caused by accepting some invalid Blowfish hashes as valid in password_verify(), letting attackers authenticate with any password if such hash exists in the database, exploit requires presence of invalid hash in password database.