GHSA-h97c-qp24-439v
GHSA-h97c-qp24-439v · Insecure State Generation in laravel/socialite
This page contains facts from public vulnerability sources. Check the original advisory before updating.
laravel/socialite versions prior to 2.0.9 are found to have an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks. The issue has been addressed in version 2.0.9 by ensuring that the state is generated using a truly random approach, enhancing the security of the OAuth flow.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
laravel/socialite Packagist
- Versions
- v1.0.0
- v1.0.1
- v1.0.2
- v1.0.3
- v2.0.0
- v2.0.1
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.0.6
- v2.0.7
- v2.0.8
- Affected ranges
- ECOSYSTEM: ≥ 1.0.0, < 2.0.9
Update to 2.0.9
Original sources
- https://github.com/laravel/socialite/pull/91
- https://github.com/laravel/socialite/commit/2ef13bae1484c44ede68e05486bce76cc0fa8dd8
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-07-23.yaml
- https://github.com/laravel/socialite
- https://osv.dev/vulnerability/GHSA-h97c-qp24-439v