GHSA-6wjw-qf87-fv5v
Laravel Encrypter Failure to decryption vulnerability
GHSA-6wjw-qf87-fv5v is a vulnerability with no CVSS score yet in illuminate/encryption, published May 15, 2024. No source lists public exploit code. Fixed in illuminate/encryption 5.5.40.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.5.40illuminate/encryption +3 more
Description
A potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false.
To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. Depending on the code within your application, this could lead to unexpected behavior when combined with weak type comparisons, for example:
<?php
$decyptedValue = decrypt($secret);
if ($decryptedValue == '') {
// Code is run even though decrypted value is false...
}
Affected packages
| Package | Affected | Fixed |
|---|---|---|
illuminate/encryptionPackagist | 5.5.0 up to 5.5.40 | 5.5.40 |
illuminate/encryptionPackagist | 5.6.0 up to 5.6.15 | 5.6.15 |
illuminate/encryptionPackagist | 5.5.0 up to 5.5.40, plus listed versions v5.5.0v5.5.16v5.5.17v5.5.2v5.5.28 Show 6 moreShow lessv5.5.33v5.5.34v5.5.35v5.5.36v5.5.37v5.5.39 | 5.5.40 |
illuminate/encryptionPackagist | 5.6.0 up to 5.6.15, plus listed versions v5.6.0v5.6.1v5.6.10v5.6.11v5.6.12 Show 10 moreShow lessv5.6.13v5.6.14v5.6.2v5.6.3v5.6.4v5.6.5v5.6.6v5.6.7v5.6.8v5.6.9 | 5.6.15 |
What each source reports
GitHub AdvisoriesNo score
Laravel Encrypter Failure to decryption vulnerability
A potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false.
To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. Depending on the code within your application, this could lead to unexpected behavior when combined with weak type comparisons, for example:
<?php
$decyptedValue = decrypt($secret);
if ($decryptedValue == '') {
// Code is run even though decrypted value is false...
}
- Record
GHSA-6wjw-qf87-fv5v- Weakness
- CWE-1240
- Updated
- 2026-11-02
OSVNo score
Laravel Encrypter Failure to decryption vulnerability
A potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false.
To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. Depending on the code within your application, this could lead to unexpected behavior when combined with weak type comparisons, for example:
<?php
$decyptedValue = decrypt($secret);
if ($decryptedValue == '') {
// Code is run even though decrypted value is false...
}
- Record
GHSA-6wjw-qf87-fv5v- Weakness
- CWE-1240
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/illuminate/encryption/commit/51667a52bd7d135c6aa40a897656ffe9d3cd072d
medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0