GHSA-q4xf-7fw5-4x8v: Laravel Hijacked authentication cookies vulnerability

medium Affects illuminate/auth. Feed 2026.10.29.4, updated 2026-10-29; published 2024-05-15; advisory modified 2024-11-29.

Laravel Hijacked authentication cookies vulnerability

Package: illuminate/auth Composer
Affected versions: >=4.0.0 and <4.1.26
Fixed in: 4.1.26
Severity: medium
Exploitation: not on CISA KEV
Published: 2024-05-15
Source: osv.dev

References

CWE-384

NVD record illuminate/auth advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2017-14775 medium Laravel Sensitive Data Exposure same package: illuminate/auth
CVE-2017-9303 medium Laravel does not properly constrain the host portion of a password-reset URL same package: illuminate/auth
2014-04-15 unknown Hijacked authentication cookies vulnerability same package: illuminate/auth
CVE-2021-36394 critical Moodle Session Fixation vulnerability same weakness: CWE-384
CVE-2015-8124 low Symfony Session Fixation Vulnerability same weakness: CWE-384
CVE-2017-12868 critical SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module same weakness: CWE-384