onyx --cves cve-2022-40482

CVE-2022-40482

score: <0.1
cvss: 5.3
epss: 0.9%
published: 2023-04-25
kev added: —
first seen: 2026-10-21

Laravel 8.x through 9.x before 9.32.0 contains a user enumeration vulnerability caused by timing attacks via HTTP/2 multiplexing in the hasValidCredentials method, letting attackers identify valid users, exploit requires sending crafted authentication requests.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2023-04-25 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-203

References 4

https://github.com/laravel/framework/pull/44069
https://github.com/laravel/framework/releases/tag/v9.32.0
https://ephort.dk/blog/laravel-timing-attack-vulnerability/
https://github.com/ephort/laravel-user-enumeration-demo