Laravel Hijacked authentication cookies vulnerability
Laravel 4.1.26 introduces security improvements for "remember me" cookies. Before this update, if a remember cookie was hijacked by another malicious user, the cookie would remain valid for a long period of time, even after the true owner of the account reset their password, logged out, etc.
This change requires the addition of a new remember_token column to your users (or equivalent) database table. After this change, a fresh token will be assigned to the user each time they login to your application. The token will also be refreshed when the user logs out of the application. The implications of this change are: if a "remember me" cookie is hijacked, simply logging out of the application will invalidate the cookie.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | illuminate/auth | >= 4.0.0, < 4.1.26 | 4.1.26 |
References
- Weakness (CWE)
CWE-384- Platform
- Composer
- Package
illuminate/auth- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q4xf-7fw5-4x8v - CC BY 4.0
Vulnerability history: illuminate/auth
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 05.2022 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 3
Disclosures per year
- 2022: 2
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 0
-
Laravel Hijacked authentication cookies vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.