{"id":"CVE-2017-14775","aliases":["CLSA-2026-1773017339","EUVD-2022-3480","GHSA-7852-w36x-6mf6","GHSA-c2v7-j5gq-wcq4","GHSA-x7p5-p2c9-phvg"],"status":"published","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01193,"percentile":0.6821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1240","CWE-200"],"published":"2017-09-27T16:00:00Z","modified":"2026-10-24T10:50:28Z","fixes":[{"ecosystem":"Packagist","package":"laravel/framework","fixed_in":["5.5.40","5.6.15","5.5.10"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"illuminate/auth","fixed_in":["5.5.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.40"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"illuminate/auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.10"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.36"},{"fixed":"5.4.36-p2+tuxcare"}]}],"versions":["5.4.36","5.4.36-p1+tuxcare"],"bundled":8},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.40"}]}],"versions":["5.0.30","5.2.41","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.11","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.10","v5.5.11","v5.5.12","v5.5.13","v5.5.14","v5.5.15","v5.5.16","v5.5.17","v5.5.18","v5.5.19","v5.5.2","v5.5.20","v5.5.21","v5.5.22","v5.5.23","v5.5.24","v5.5.25","v5.5.26","v5.5.27","v5.5.28","v5.5.29","v5.5.3","v5.5.30","v5.5.31","v5.5.32","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.38","v5.5.39","v5.5.4","v5.5.5","v5.5.6","v5.5.7","v5.5.8","v5.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.15"}]}],"versions":["v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.2","v5.6.3","v5.6.4","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.10"}]}],"versions":["5.0.30","5.2.41","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.11","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.2","v5.5.3","v5.5.4","v5.5.5","v5.5.6","v5.5.7","v5.5.8","v5.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"illuminate/auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.10"}]}],"versions":["v1.0.0","v1.1.0","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0-BETA1","v4.2.1","v4.2.12","v4.2.16","v4.2.17","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.22","v5.0.25","v5.0.26","v5.0.28","v5.0.33","v5.0.4","v5.1.1","v5.1.13","v5.1.16","v5.1.2","v5.1.20","v5.1.22","v5.1.25","v5.1.28","v5.1.30","v5.1.31","v5.1.41","v5.1.6","v5.1.8","v5.2.0","v5.2.19","v5.2.21","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.31","v5.2.32","v5.2.37","v5.2.43","v5.2.45","v5.2.6","v5.2.7","v5.3.0","v5.3.16","v5.3.23","v5.3.4","v5.4.0","v5.4.13","v5.4.17","v5.4.19","v5.4.27","v5.4.36","v5.4.9","v5.5.0","v5.5.2"]}],"products":[{"vendor":"laravel","product":"laravel"}],"references":[{"url":"https://github.com/laravel/framework/releases/tag/v5.5.10","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/laravel/framework/pull/21320","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","report","web"]},{"url":"https://laravel-news.com/laravel-v5-5-11","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://github.com/laravel/framework/commit/28e53f23a76206fb130e9a54eb95aa3f010e79c9","tags":["web"]},{"url":"https://github.com/laravel/framework/commit/886d261df0854426b4662b7ed5db6a1c575a4279","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2018-03-30-1.yaml","tags":["web"]},{"url":"https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7852-w36x-6mf6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14775","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/auth/CVE-2017-14775.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2017-14775.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c2v7-j5gq-wcq4"},{"url":"https://github.com/laravel/framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-14775","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","status":"published","published":"2017-09-27T16:00:00Z","modified":"2024-09-17T01:56:34.828Z","updated_at":"2026-11-02T14:33:11.928814Z"}],"euvd":[{"id":"EUVD-2022-3480","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","status":"published","published":"2017-09-27T16:00:00Z","modified":"2024-09-17T01:56:34Z","updated_at":"2026-11-03T00:28:45.29969Z"}],"ghsa":[{"id":"GHSA-c2v7-j5gq-wcq4","title":"Laravel Sensitive Data Exposure","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","status":"published","published":"2022-05-17T00:34:22Z","modified":"2024-02-05T10:42:41Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:35.293818Z"},{"id":"GHSA-7852-w36x-6mf6","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n\u003c?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","status":"published","published":"2024-05-15T22:08:06Z","modified":"2024-05-15T22:08:07Z","cwes":["CWE-1240"],"updated_at":"2026-11-02T14:37:49.987036Z"}],"nvd":[{"id":"CVE-2017-14775","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","status":"published","published":"2017-09-28T01:29:01.857Z","modified":"2026-06-17T01:06:46.063Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:59.716532Z"}],"osv":[{"id":"CVE-2017-14775","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","status":"published","published":"2017-09-28T01:29:01.857Z","modified":"2026-10-24T10:50:28.431722592Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"GHSA-c2v7-j5gq-wcq4","title":"Laravel Sensitive Data Exposure","description":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","status":"published","published":"2022-05-17T00:34:22Z","modified":"2024-02-16T08:26:21.423376Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"CLSA-2026-1773017339","title":"TuxCare security update for laravel/framework (10 CVEs)","description":"TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:04.641650282Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"GHSA-7852-w36x-6mf6","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n\u003c?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","status":"published","published":"2024-05-15T22:08:06Z","modified":"2024-11-29T05:40:57.344982Z","cwes":["CWE-1240"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}