Scan report
hybridauth / hybridauth
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 1
- Medium
- 1
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
No issues of this kind were found.
- High
- 2
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 1
- Uncertain
- 1
- Likely noise
- 2
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
1 finding likely need attention, 2 look like noise. Most notable: SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= false) in /src/Thirdparty/OpenID/LightOpenID.php (54% confidence).
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/Thirdparty/OpenID/LightOpenID.php line 284
- Likely real
- Yes, 54% confidence
SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= false)
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/HttpClient/Curl.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/Thirdparty/OpenID/LightOpenID.php
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/Storage/Session.php line 63
- Likely real
- Uncertain, 36% confidence
Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers).
$value = unserialize($value['lateObject']);
No findings match these filters.