Skip to content
OpenAdvisories

Package · Packagist

illuminate/auth

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium —
    GHSA-q4xf-7fw5-4x8v

    Laravel Hijacked authentication cookies vulnerability

    Laravel 4.1.26 introduces security improvements for "remember me" cookies. Before this update, if a remember cookie was hijacked by another malicious user, the cookie would remain valid for a long period of time, even after the true owner of the account reset…

    illuminate/auth Packagist
  • Medium 5.9
    CVE-2017-14775

    Laravel Sensitive Data Exposure

    Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.

    laravel/framework illuminate/auth Packagist
  • Medium 6.1
    CVE-2017-9303

    Laravel does not properly constrain the host portion of a password-reset URL

    Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.

    laravel/framework illuminate/auth laravel/laravel Packagist