GHSA-7852-w36x-6mf6: Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

The vulnerability stems from insufficient IV validation in the validPayload method. The pre-patch implementation only checked for the existence of IV/value/mac fields but didn't verify the IV length matches the cipher's requirements (via openssl_cipher_iv_length). This allowed attackers to craft payloads with invalid IV lengths that would pass initial validation but fail during actual decryption, returning false. The commit 28e53f2 specifically adds the IV length check to this function, confirming it as the vulnerable point. The function's role in payload validation makes it the critical component enabling this cryptographic weakness (CWE-1240).