PT-2024-40318 · Laravel · Laravel/Socialite

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions laravel/socialite versions prior to 2.0.9

Description The issue concerns an insecure state generation mechanism in the OAuth authentication process, which poses security risks. This has been addressed by ensuring the state is generated using a truly random approach, thus enhancing the security of the OAuth flow.

Recommendations For versions prior to 2.0.9, update to version 2.0.9 to ensure the state is generated securely, enhancing the security of the OAuth flow.

Weakness Enumeration

CWE-331

Related Identifiers

GHSA-H97C-QP24-439V

Affected Products

Laravel/Socialite

References · 5

• https://osv.dev/vulnerability/GHSA-h97c-qp24-439v · Vendor Advisory
• https://github.com/laravel/socialite · Note
• https://github.com/laravel/socialite/pull/91 · Note
• https://github.com/laravel/socialite/commit/2ef13bae1484c44ede68e05486bce76cc0fa8dd8 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-07-23.yaml · Note