GHSA-7fjp-g4m7-fx23
User (Encrypted) Password Field Being Serialised
Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.
Patches
Issue has been patched in version 0.3.7-beta and onwards.
Workarounds
Add the 'password' field to the Users model file in the hidden array:
/**
* The attributes that should be hidden for arrays.
*
* @var array
*/
protected $hidden = [
'remember_token',
'password',
];
For more information
If you have any questions or comments about this advisory:
- Open an issue in pwweb/laravel-core
- Email us at security@pw-websolutions.com
What each source reports
GitHub AdvisoriesNo score
User (Encrypted) Password Field Being Serialised
Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.
Patches
Issue has been patched in version 0.3.7-beta and onwards.
Workarounds
Add the 'password' field to the Users model file in the hidden array:
/**
* The attributes that should be hidden for arrays.
*
* @var array
*/
protected $hidden = [
'remember_token',
'password',
];
For more information
If you have any questions or comments about this advisory:
- Open an issue in pwweb/laravel-core
- Email us at security@pw-websolutions.com
- Record
GHSA-7fjp-g4m7-fx23- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
User (Encrypted) Password Field Being Serialised
Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.
Patches
Issue has been patched in version 0.3.7-beta and onwards.
Workarounds
Add the 'password' field to the Users model file in the hidden array:
/**
* The attributes that should be hidden for arrays.
*
* @var array
*/
protected $hidden = [
'remember_token',
'password',
];
For more information
If you have any questions or comments about this advisory:
- Open an issue in pwweb/laravel-core
- Email us at security@pw-websolutions.com
- Record
GHSA-7fjp-g4m7-fx23- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pwweb/laravel-corePackagist | through 0.3.6-beta | 0.3.7-beta |
pwweb/laravel-corePackagist | before 0.3.7-beta, plus listed versions 0.1.0-beta0.1.1-beta0.1.10-beta0.1.11-beta0.1.12-beta Show 17 moreShow less0.1.13-beta0.1.2-beta0.1.3-beta0.1.4-beta0.1.5-beta0.1.6-beta0.1.7-beta0.1.8-beta0.1.9-beta0.2.1-beta0.2.2-beta0.3.0-beta0.3.1-beta0.3.2-beta0.3.3-beta0.3.4-beta0.3.5-beta | 0.3.7-beta |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-7fjp-g4m7-fx23 is a vulnerability with no CVSS score yet in pwweb/laravel-core, published April 13, 2021. No source lists public exploit code. Fixed in pwweb/laravel-core 0.3.7-beta.