GHSA-p62r-7637-3wwc

GHSA-p62r-7637-3wwc · Laravel Hijacked authentication cookies vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Laravel 4.1.26 introduces security improvements for "remember me" cookies. Before this update, if a remember cookie was hijacked by another malicious user, the cookie would remain valid for a long period of time, even after the true owner of the account reset their password, logged out, etc. This change requires the addition of a new remember_token column to your users (or equivalent) database table. After this change, a fresh token will be assigned to the user each time they login to your application. The token will also be refreshed when the user logs out of the application. The implications of this change are: if a "remember me" cookie is hijacked, simply logging out of the application will invalidate the cookie.

Fix available

Published

2024-05-15T22:06:42Z

Updated

2024-11-29T05:26:31.327092Z

Stack: php

Check your server →