User Enumeration Vulnerability in Laravel Authentication Method

CVE-2022-40482

What is CVE-2022-40482?

The authentication system in Laravel versions 8.x through 9.x, prior to 9.32.0, is susceptible to a user enumeration vulnerability due to improper handling of early returns within the hasValidCredentials method. This flaw may allow attackers to exploit timing attacks, particularly with HTTP/2 multiplexing, enabling the identification of valid or invalid usernames based on the response time, thereby compromising the security of user accounts.

References