Insecure State Generation in laravel/socialite
laravel/socialite versions prior to 2.0.9 are found to have an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks. The issue has been addressed in version 2.0.9 by ensuring that the state is generated using a truly random approach, enhancing the security of the…
As published by the sources
Affected packages
- Affected
>=1.0.0,<2.0.9Fixed in2.0.9
Derived from the fixed versions above
What to do
Upgrade laravel/socialite to 2.0.9 or later.
composer update laravel/socialite --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
laravel/socialite versions prior to 2.0.9 are found to have an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks. The issue has been addressed in version 2.0.9 by ensuring that the state is generated using a truly random approach, enhancing the security of the OAuth flow.
References
- Advisoryhttps://github.com/laravel/socialite/pull/93
- Webhttps://github.com/laravel/socialite/pull/91
- Webhttps://github.com/laravel/socialite/commit/2ef13bae1484c44ede68e05486bce76cc0fa8dd8
- Webhttps://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/socialite/2015-07-23.yaml
- Packagehttps://github.com/laravel/socialite