{"id":"CVE-2017-14775","title":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token c","published":"2017-09-27T21:29:01.857Z","updated":"2026-06-16T21:06:46.063Z","severity":"medium","cvssScore":5.9,"epss":0.01193,"epssPct":0.68441,"kev":false,"maturity":"none","actionScore":23,"primaryVendor":"laravel","primaryProduct":"laravel","cweId":"CWE-200","fixAvailable":true,"tags":["pre-auth","info-leak","remote","no-ui"],"epssDelta7":0,"summary":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","cvssVector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Exposure of Sensitive Information to an Unauthorized Actor","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-09-17T01:56:34.828Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:50:00.946Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"laravel","product":"laravel","cpe":"cpe:2.3:a:laravel:laravel"}],"references":[{"url":"https://github.com/laravel/framework/pull/21320","tags":"Issue Tracking,Mailing List,Third Party Advisory"},{"url":"https://github.com/laravel/framework/releases/tag/v5.5.10","tags":"Release Notes,Third Party Advisory"},{"url":"https://laravel-news.com/laravel-v5-5-11","tags":"Issue Tracking,Vendor Advisory"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"laravel","product":"laravel","version":"*","vsi":null,"vse":null,"vei":"5.5.9","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}