-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure token comparison in remember_me authentication. The GitHub pull request #21320 shows both DatabaseUserProvider and EloquentUserProvider had their retrieveByToken methods modified to replace direct string comparisons ($user->getRememberToken() == $token) with hash_equals() for constant-time comparison. This confirms these functions were the vulnerable points where timing attacks could extract authentication tokens through response time analysis.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | < 5.5.10 | 5.5.10 |
| illuminate/auth | composer | < 5.5.10 | 5.5.10 |