Steam Socialite Provider v1 does not correctly validate openid server
Impact
The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server.
Patches
This vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.
For more information
If you have any questions or comments about this advisory:
- Open an issue in SocialiteProviders/Providers
- Email us at socialite@atymic.dev
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | socialiteproviders/steam | < 3.0 | 3.0 |
References
- Weakness (CWE)
CWE-346- Platform
- Composer
- Package
socialiteproviders/steam- Disclosed
- 29.01.2021
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hhw9-35p2-q2c5 - CC BY 4.0
Vulnerability history: socialiteproviders/steam
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.