CVE-2022-46170 CodeIgniter is vulnerable to improper authentication via Session Handlers

What is CVE-2022-46170?

CVE-2022-46170 is a high-severity authentication bypass vulnerability in CodeIgniter4, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Weakness: CWE-287

Which versions are affected by CVE-2022-46170?

3 open source packages ship an affected version, including codeigniter4/framework and codeigniter. It affects 1 product.

Products include Codeigniter Codeigniter.

How do I fix CVE-2022-46170?

Upgrade codeigniter4/framework to 4.2.11 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-46170 being exploited?

There is no known exploitation of CVE-2022-46170 in the wild and no public exploit code.

Other vulnerabilities in CodeIgniter4

• CVE-2025-54418 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability Critical 9.8
• CVE-2023-32692 Remote Code Execution Vulnerability in Validation Placeholders Critical 9.8
• CVE-2022-40824 SQL injection in n/a Critical 9.8
• CVE-2022-40825 SQL injection in n/a Critical 9.8
• CVE-2022-40826 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-codeigniter-2022-46170, GHSA-6cq5-8cj7-g558.