GHSA-7fjv-25q9-2w88
GHSA-7fjv-25q9-2w88 · State Guessing Vulnerability in laravel/socialite
This page contains facts from public vulnerability sources. Check the original advisory before updating.
laravel/socialite versions prior to 2.0.10 are susceptible to a security vulnerability related to state guessing during OAuth authentication. This vulnerability could potentially lead to session hijacking, allowing attackers to compromise user sessions. The issue has been addressed and fixed in version 2.0.10.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
laravel/socialite Packagist
- Versions
- v1.0.0
- v1.0.1
- v1.0.2
- v1.0.3
- v2.0.0
- v2.0.1
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.0.6
- v2.0.7
- v2.0.8
- v2.0.9
- Affected ranges
- ECOSYSTEM: ≥ 1.0.0, < 2.0.10
Update to 2.0.10
Original sources
- https://github.com/laravel/socialite/pull/93
- https://github.com/laravel/socialite/commit/3d9ed9f4703de82a89541e2458f64de348a60a99
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-08-03.yaml
- https://github.com/laravel/socialite
- https://osv.dev/vulnerability/GHSA-7fjv-25q9-2w88