TI-2024-33782 Aliases CVE-2024-50347 GHSA-pfrr-xvrf-pxjx

Laravel Reverb has Missing API Signature Verification

LOW 28CWE-347Published 2024-10-31 · Updated 2024-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00346 28th percentileScored 2026-11-07

Fix Fixed reverb (laravel): 1.4.0laravel/reverb (Packagist): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Laravel	reverb	before 1.4.0	1.4.0	Patch available	CNA
—	laravel/reverb (Packagist)	before 1.4.0	1.4.0	Patch available	GHSA-pfrr-xvrf-pxjx

reverb VendorLaravel Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA
laravel/reverb (Packagist) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-pfrr-xvrf-pxjx

Remediation

Fix · CNA reverb (laravel) Fixed in 1.4.0
Fix · GHSA-pfrr-xvrf-pxjx laravel/reverb (Packagist) Fixed in 1.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-50347
2026-10-03 Alias added: GHSA-pfrr-xvrf-pxjx

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-50347

Other 5

TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
TI-2025-33912 Livewire vulnerable to remote command execution during property update hydration KEVCVSS 4.0CRITICAL 9.2
TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences