CVE-2022-46170 - CVE House
Back to Database
Status published High CVE-2022-46170

CodeIgniter is vulnerable to improper authentication via Session Handlers

Vulnerability Description

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-46170

Credits & Attribution

No credits recorded in the NVD database.

References

More from codeigniter4

View All →
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
Critical 9.8
CVE-2025-24013
CodeIgniter validation of header name and value
Medium 5.3
CVE-2024-29904
CodeIgniter4 Language class DoS Vulnerability
High 7.5
CVE-2023-48708
Insertion of Sensitive Information into Log in codeigniter4/shield
Medium 5
CVE-2023-48707
Cleartext Storage of Sensitive Information in codeigniter4/shield
Medium 5

Affected Vendor

codeigniter4

View all reports →

Affected Software

CodeIgniter4
Vulnerable Versions:
< 4.2.11

Timeline

Official Publish: December 22nd, 2022
Last Modified: April 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access