PT-2024-40159 · Laravel · Laravel/Socialite

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: laravel/socialite versions prior to 2.0.10

Description: The issue is related to state guessing during OAuth authentication, which could potentially lead to session hijacking, allowing attackers to compromise user sessions.

Recommendations: For versions prior to 2.0.10, update to version 2.0.10 to resolve the issue.

Related Identifiers

GHSA-7FJV-25Q9-2W88

Affected Products

Laravel/Socialite

References · 5

• https://osv.dev/vulnerability/GHSA-7fjv-25q9-2w88 · Vendor Advisory
• https://github.com/laravel/socialite · Note
• https://github.com/laravel/socialite/commit/3d9ed9f4703de82a89541e2458f64de348a60a99 · Note
• https://github.com/laravel/socialite/pull/93 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-08-03.yaml · Note