Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
illuminate/broadcasting
master @ 3c6ee5f
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
BroadcastManager.php: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
CSRF: Misconfigured route middleware can accidentally exempt critical broadcasting authentication endpoints from CSRF/Request Forgery protections, allowing malicious external sites to register or authenticate to channels on behalf of users.
Auth Bypass: Improper parsing of channel name prefixes prior to access control verification can cause channel authentication checks to evaluate incorrect strings, resulting in unauthorized users gaining access to restricted subscription channels.