doctrine/doctrine-module zero-valued authentication credentials vulnerability
Date: 2024-05
Affected: composer/doctrine/doctrine-module
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVSS: 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N)

it is possible (under certain circumstances) to obtain a valid `Zend\Authentication` identity even without knowing the user's credentials by using a numerically valued credential in `DoctrineModule\Authentication\Adapter\ObjectRepository`.


Mitigations:

Architectural layers (MAESTRO):