{"id":"CVE-2017-14775","details":"Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.","aliases":["GHSA-c2v7-j5gq-wcq4"],"modified":"2026-07-08T11:35:26.774424Z","published":"2017-09-28T01:29:01.857Z","references":[{"type":"ADVISORY","url":"https://github.com/laravel/framework/releases/tag/v5.5.10"},{"type":"REPORT","url":"https://github.com/laravel/framework/pull/21320"},{"type":"REPORT","url":"https://laravel-news.com/laravel-v5-5-11"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laravel/framework","events":[{"introduced":"0"},{"last_affected":"a0fdfd2c90318c107b6a8d69189ec9a6607379e3"},{"fixed":"6c63130c001bd0b2bec30d330e110be63b5caee6"}],"database_specific":{"cpe":"cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.5.9"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v5.5.9","v5.5.7","v5.5.6","v5.5.5","v5.5.4","v5.5.3","v5.5.2","v5.5.1","v5.5.0","v4.1.0","v4.0.0","v4.0.0-BETA4","v4.0.0-BETA3","v4.0.0-BETA2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14775.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}