GitHub Advisoryadvisory · Packagist

GHSA-7fjv-25q9-2w88 State Guessing Vulnerability in laravel/socialite

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: laravel/socialite
Severity: Moderate
Reviewed: 2024-05-15

Affected packages

• Packagist laravel/socialite: >= 1.0.0, < 2.0.10 → fixed in 2.0.10

Description

laravel/socialite versions prior to 2.0.10 are susceptible to a security vulnerability related to state guessing during OAuth authentication. This vulnerability could potentially lead to session hijacking, allowing attackers to compromise user sessions. The issue has been addressed and fixed in version 2.0.10.

References

https://github.com/laravel/socialite/pull/93 web
https://github.com/laravel/socialite/commit/3d9ed9f4703de82a89541e2458f64de348a60a99 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-08-03.yaml web
https://github.com/laravel/socialite package