Improper Authentication

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Improper Authentication via TokenGuard in src/Illuminate/Auth/TokenGuard.php, where the token retrieved from the request is not validated to be a string before being used for...

WS-2026-0147

laravel/framework v5.2.0-beta1 - v11.56.0, v12.0.0 - v12.67.0, v13.0.0 - v13.26.1 and illuminate/auth v5.2.0 - v11.51.0, v12.0.0 - v12.67.0, v13.0.0 - v13.27.0: TokenGuard passes non-string apitoken values arrays or JSON scalars to the user provider lookup, so on MySQL/MariaDB type juggling match...

DEBIAN-CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

CVE-2022-40482: Observable Discrepancy

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...

CVE-2022-40482

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...