Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Google Maps Laravel package may expose API key

CVE-2026-105222 · published 14 days ago
Summary

The alexpechkarev/google-maps package for Laravel does not check the security certificate when it talks to Google Maps. This lets a network attacker intercept the request, see the API key in the URL, and possibly change the returned data. Update the package to a version that validates certificates or change the configuration to enable certificate checking.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
alexpechkarev google-maps <= 12.16
Original advisory text
alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105222 · NVD
CVE-2026-105222 · MITRE
CVE-2026-105222 · OSV
Track software like this
Free during beta