{"id":"CVE-2022-40482","aliases":["DEBIAN-CVE-2022-40482","EUVD-2022-43760","GHSA-5qxg-5vwh-7j5j"],"status":"published","title":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be...","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00888,"percentile":0.5956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2023-04-25T00:00:00Z","modified":"2026-10-31T11:00:05Z","fixes":[{"ecosystem":"Debian:12","package":"php-laravel-framework","fixed_in":["8.83.26+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-laravel-framework","fixed_in":["8.83.26+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-laravel-framework","fixed_in":["8.83.26+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.83.26+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.83.26+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.83.26+dfsg-1"}]}]}],"products":[{"vendor":"laravel","product":"framework"}],"references":[{"url":"https://ephort.dk/blog/laravel-timing-attack-vulnerability/","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","article"]},{"url":"https://github.com/ephort/laravel-user-enumeration-demo","tags":["x_transferred","Exploit","Third Party Advisory","package"]},{"url":"https://github.com/laravel/framework/pull/44069","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/laravel/framework/releases/tag/v9.32.0","tags":["x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40482","tags":["advisory"]},{"url":"https://ephort.dk/blog/laravel-timing-attack-vulnerability"},{"url":"https://github.com/advisories/GHSA-5qxg-5vwh-7j5j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/40xxx/CVE-2022-40482.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-40482","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-40482","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2025-02-03T20:49:55.862Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:34:30.493103Z"}],"euvd":[{"id":"EUVD-2022-43760","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2025-02-03T20:49:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:06.761301Z"}],"ghsa":[{"id":"GHSA-5qxg-5vwh-7j5j","title":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be...","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","status":"published","published":"2023-04-25T21:30:28Z","modified":"2024-04-04T03:40:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:56:17.471503Z"}],"nvd":[{"id":"CVE-2022-40482","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","status":"published","published":"2023-04-25T19:15:10.18Z","modified":"2026-06-17T05:01:26.353Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:07:37.42466Z"}],"osv":[{"id":"CVE-2022-40482","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2026-10-28T02:31:11.364549009Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"DEBIAN-CVE-2022-40482","description":"The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\\Auth\\SessionGuard class when a user is found to not exist.","status":"published","published":"2023-04-25T19:15:10.18Z","modified":"2026-11-03T06:02:45.51344451Z","updated_at":"2026-11-03T06:43:43.638289Z"}]}}