CVE-2025-48493: Yii 2 Redis Exposes AUTH Parameters in Logs on Connection Failure
Summary
CVE-2025-48493: Yii 2 Redis may expose AUTH parameters in logs in case of connection failure. Affects yiisoft/yii2-redis versions < 2.0.20. Fixed in 2.0.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Yii 2 Redis is a PHP extension that provides a Redis client for Yii Framework applications. It allows developers to interact with Redis databases easily, leveraging its caching and data storage capabilities. The extension is widely used for improving application performance and scalability. However, it has a vulnerability that can expose sensitive authentication information in logs, particularly during connection failures.
Vulnerability Detail
The vulnerability arises when the Yii 2 Redis extension encounters a connection failure. In such cases, it logs the sequence of commands sent to Redis, including the AUTH parameters, which contain the username and password in plain text. This exposure can lead to unauthorized access if an attacker gains access to the logs, potentially compromising the security of the application and its data.
How To Fix
Minimum fixed version
2.0.20
This is the first release that contains the fix.
composer require yiisoft/yii2-redis:2.0.20Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your logging settings to avoid logging sensitive information. This can be done by adjusting the logging level or by implementing a custom logging handler that filters out sensitive data.
Conclusion
The Yii 2 Redis vulnerability (CVE-2025-48493) poses a significant risk by exposing sensitive authentication details in logs during connection failures. It is crucial to update to the patched version (2.0.20 or later) to mitigate this risk. Additionally, consider using Vulert for ongoing monitoring of vulnerabilities in your open-source dependencies.
See every vulnerability recorded for yiisoft/yii2-redis →
FAQ
CVE-2025-48493 is a vulnerability in the Yii 2 Redis extension that exposes authentication parameters in logs during connection failures.
If an attacker gains access to the logs, they can retrieve sensitive authentication information, potentially leading to unauthorized access to your Redis database.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
If an immediate update is not possible, consider implementing logging configurations that prevent sensitive information from being logged as a temporary measure.
Yes, Vulert provides a service that allows you to monitor and receive alerts for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-redis.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
