Laravel Reverb Missing API Signature Verification
Impact
A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.
The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.
[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.
The following endpoints were affected:
POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminatePatches
The issue was resolved by #252 and the patch released in v1.4.0.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | laravel/reverb | < 1.4.0 | 1.4.0 |
References
- https://github.com/laravel/reverb/security/advisories/GHSA-pfrr-xvrf-pxjx
- https://nvd.nist.gov/vuln/detail/CVE-2024-50347
- https://github.com/laravel/reverb/pull/252
- https://github.com/laravel/reverb/commit/73cc140d76e803b151fc2dd2e4eb3eb784a82ee2
- https://github.com/laravel/reverb
- https://github.com/laravel/reverb/releases/tag/v1.4.0
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-345, CWE-347- Platform
- Composer
- Package
laravel/reverb- Disclosed
- 31.10.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-pfrr-xvrf-pxjx - CC BY 4.0
Vulnerability history: laravel/reverb
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 10.2024 01.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
Disclosures per year
- 2024: 1
- 2025: 0
- 2026: 1
-
Laravel Reverb Missing API Signature Verification this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.