Read the docs
TI-2017-10833 Aliases CVE-2017-14775GHSA-c2v7-j5gq-wcq4

Laravel before 5.5.10 mishandles the remember_me token verification process because…

Priority LOW 29CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.

Why it matters now

EPSS 0.01193 68th percentileScored 2026-11-07
Fix Fixed laravel/framework (Packagist): 5.5.10illuminate/auth (Packagist): 5.5.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—laravel/framework (Packagist)before 5.5.105.5.10Patch availableGHSA-c2v7-j5gq-wcq4
—illuminate/auth (Packagist)before 5.5.105.5.10Patch availableGHSA-c2v7-j5gq-wcq4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • laravel/framework (Packagist) Vendor— Affected before 5.5.10 Fixed in 5.5.10 Patch available GHSA-c2v7-j5gq-wcq4
  • illuminate/auth (Packagist) Vendor— Affected before 5.5.10 Fixed in 5.5.10 Patch available GHSA-c2v7-j5gq-wcq4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*up to 5.5.9VulnerableLaravel
  • cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* Versions up to 5.5.9 Vulnerable ·Laravel

Remediation

  • Fix · GHSA-c2v7-j5gq-wcq4 laravel/framework (Packagist) Fixed in 5.5.10 Advisory →
  • Fix · GHSA-c2v7-j5gq-wcq4 illuminate/auth (Packagist) Fixed in 5.5.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-14775
  2. 2026-10-03 Alias added: GHSA-c2v7-j5gq-wcq4

References

Advisory 4

Other 2

  • TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
  • TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
  • TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
  • TI-2022-02676 Laravel deserialization CVSS 3.1HIGH 8.8
  • TI-2021-04364 Query Binding Exploitation in Laravel CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences