GHSA-87gw-9fr8-4p45: 
PHP vulnerability analysis and mitigation

Impact

In 2.2.3 and earlier, both clients kept the params of the previous request and sent them again with the next request that set no params of its own.

• BitGoSDK: after unlockSession(), a call such as getWalletByAddress() or getWalletTransaction() sent the OTP and duration again. GET requests put them in the URL query string (?otp=…&duration=600), where they can end up in proxy, load balancer and server logs.
• BitGoExpress: the walletPassphrase from a send or build call was posted again to the next call without params, for example createKeychain(). All of these requests go to the same BitGo or BitGo Express host the client is configured for. The params are not sent to third parties, but they reach endpoints that don't need them and can be logged in plain text.

Patches

Fixed in 2.3.0. Params are reset after every request. 2.3.0 requires PHP 7.4 or later and changes some behaviour (see the changelog), so check it before upgrading.

Workarounds

If you can't upgrade, create a new BitGoSDK or BitGoExpress instance for each request, so no params are carried over.

References

• https://github.com/neto737/BitGoSDK-PHP/blob/main/CHANGELOG.md#230---2026-10-18