User (Encrypted) Password Field Being Serialised
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
### Impact Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed. ### Patches Issue has been patched in version 0.3.7-beta and onwards. ### Workarounds Add the 'password' field to the Users model file in the hidden array: ```php /** * The attributes that should be hidden for arrays. * * @var array */ protected $hidden = [ 'remember_token', 'password', ]; ``` ### For more information If you have any questions or comments about this advisory: * Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core) * Email us at [[email protected]](mailto:[email protected])
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pwweb/laravel-core (Packagist) | before 0.3.7-beta | 0.3.7-beta | Patch available | GHSA-7fjp-g4m7-fx23 |
- pwweb/laravel-core (Packagist) Vendor— Affected before 0.3.7-beta Fixed in 0.3.7-beta Patch available GHSA-7fjp-g4m7-fx23
Remediation
- Fix · GHSA-7fjp-g4m7-fx23 pwweb/laravel-core (Packagist) Fixed in 0.3.7-beta Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-7fjp-g4m7-fx23
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences