CVE-2024-50347

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.

• CWE-347

• https://github.com/laravel/reverb/commit/73cc140d76e803b151fc2dd2e4eb3eb784a82ee2
• https://github.com/laravel/reverb/pull/252
• https://github.com/laravel/reverb/releases/tag/v1.4.0
• https://github.com/laravel/reverb/security/advisories/GHSA-pfrr-xvrf-pxjx

Published

Oct 31, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50341symfony/security-bundle is a module for the Symphony PHP fra…3.1
• CVE-2024-50342symfony/http-client is a module for the Symphony PHP framewo…4.3
• CVE-2024-50343symfony/validator is a module for the Symphony PHP framework…3.1
• CVE-2024-50344I, Librarian is an open-source version of a PDF managing Saa…4.6
• CVE-2024-50345symfony/http-foundation is a module for the Symphony PHP fra…6.1
• CVE-2024-50346WebFeed is a lightweight web feed reader extension for Firef…5.1
• CVE-2024-50348InstantCMS is a free and open source content management syst…5.4
• CVE-2024-50349Git is a fast, scalable, distributed revision control system…4.7
• CVE-2024-5035The affected device expose a network service called "rftest"…8.8
• CVE-2024-50350LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-50351LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-50352LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4