HybridAuth up to version 3.12.2 has a flaw in its SSL handling component, Curl.php, that allows an attacker to circumvent certificate checks by manipulating curlOptions. This improper certificate validation (CWE‑295) could let an attacker perform man‑in‑the‑middle or other credential‑stealing attacks, exposing confidential data, while the system may accept unauthorized connections (CWE‑287).

The vulnerability is present in the HybridAuth library, including all versions up through 3.12.2, and affects any application that relies on that code for OAuth or other authentication flows.

The CVSS score of 6.3 indicates moderate severity. EPSS information is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires remote access, a high attack complexity, and is deemed difficult. Attackers could craft a request that overrides the curl options, forcing the library to accept untrusted certificates. Until the library is updated, this weakness remains exploitable.