Timing Attack

laravel is vulnerable to timing attacks. The library does not compare the rememberme token in constant time, allowing malicious users to guess the valid token based on the time that a comparison takes...

CVE-2017-14775

Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison...