Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Laravel Socialite OAuth State Generation Exposes Authentication Risk
published 2 years ago
Summary
If not updated, older versions of Laravel Socialite can leak information during OAuth login, potentially allowing attackers to hijack sessions. This has been fixed in version 2.0.9. Update to the latest version to ensure secure OAuth authentication.
What to do
- Update laravel socialite to version 2.0.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | laravel | socialite |
>= 1.0.0, < 2.0.9 Fix: upgrade to 2.0.9
|
Original advisory text
Insecure State Generation in laravel/socialite
laravel/socialite versions prior to 2.0.9 are found to have an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks. The issue has been addressed in version 2.0.9 by ensuring that the state is generated using a truly random approach, enhancing the security of the OAuth flow.
Type
CWE-331Insufficient Entropy
Timeline
Published15 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-h97c-qp24-439v · GHSA
Track software like this
Free during beta