CVE-2014-8684: CodeIgniter and Kohana hash comparison flaw enables session cookie spoofing and PHP object injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 3.0 score is 9.8 (critical) with network reachability, no authentication, and high impact, and EPSS is extremely high, making this a top remediation priority despite no KEV listing.

What it is

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 compare cryptographic hashes using standard string comparison operators, which are not constant-time. This makes it easier for remote attackers to spoof session cookies and then conduct PHP object injection attacks. The flaw matters because it undermines session integrity in widely used PHP frameworks and can lead to full compromise of the application.

Impact

An attacker can forge valid session cookies and, through PHP object injection, potentially execute arbitrary code or otherwise take control of the affected application. This can result in complete loss of confidentiality, integrity, and availability.

Attack surface

The vulnerability is reachable remotely over the network with no authentication or user interaction required, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N. Attackers interact with the application's session handling by supplying crafted cookies.

Exploitation

The record does not list this CVE in CISA KEV, but EPSS is very high at 0.71711 (99.392nd percentile), indicating a strong likelihood of exploitation activity. Reference tags are advisory and mailing list entries, with no public exploit code explicitly tagged.

What to do

• Upgrade CodeIgniter to 3.0 or later and Kohana to a version after 3.3.2 to obtain constant-time hash comparison.
• If immediate upgrade is not possible, replace standard string comparison of cryptographic hashes with a constant-time comparison function such as hash_equals in PHP.
• Rotate session signing keys and invalidate existing sessions after applying the fix to prevent use of previously forged cookies.
• Review and restrict PHP object deserialization paths that could be reached via session data, and avoid unserializing untrusted input.
• Monitor vendor advisories for backported patches if using a fork or embedded copy of these frameworks.

Detection

• Inspect web server and application logs for unusual session cookie values or repeated authentication failures that may indicate cookie spoofing attempts.
• Search for PHP object injection indicators such as unexpected serialized objects in session data or requests containing serialized payloads.
• Monitor for anomalous outbound connections or process execution originating from the web application after suspicious session activity.
• Use file integrity monitoring to detect unexpected changes to application files that could follow successful object injection.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.