Lara Dashboard Authentication Bypass Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- lara-dashboard (npm)
- Affected versions
- >= v1.2.0, <= v1.2.0 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= Laravel12.x-module-logs, <= Laravel12.x-module-logs or >= Laravel12.x-tailadmin, <= Laravel12.x-tailadmin or >= v11.x-main, <= v11.x-main or >= Laravel11.x, <= Laravel11.x or >= Laravel9.x, <= Laravel9.x or >= Laravel7.x, <= Laravel7.x or >= Day10, <= Day10 or >= Day9, <= Day9 or >= Day8, <= Day8 or >= Day7, <= Day7 or >= Day6, <= Day6 or >= Day5, <= Day5 or >= Day4, <= Day4 or >= Day3, <= Day3 or >= Day2, <= Day2 or >= Day1, <= Day1
- Patched version
- 1.3.0
An early warning has been issued for a critical authentication bypass vulnerability in Lara Dashboard versions before 1.3.0. This vulnerability allows unauthenticated attackers to gain full access to user accounts.
What happened
Lara Dashboard versions before 1.3.0 reportedly contain an authentication bypass vulnerability in the screenshot-login route. This vulnerability allows unauthenticated attackers to authenticate as any user by providing a registered email address. Attackers can exploit this by requesting the GET /screenshot-login/{email} endpoint, which grants them a fully authenticated session. The vulnerability is under investigation and has not yet been exploited in the wild.
The affected versions of Lara Dashboard include all versions before 1.3.0, specifically versions >= v1.2.0, <= v1.2.0 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= Laravel12.x-module-logs, <= Laravel12.x-module-logs or >= Laravel12.x-tailadmin, <= Laravel12.x-tailadmin or >= v11.x-main, <= v11.x-main or >= Laravel11.x, <= Laravel11.x or >= Laravel9.x, <= Laravel9.x or >= Laravel7.x, <= Laravel7.x or >= Day10, <= Day10 or >= Day9, <= Day9 or >= Day8, <= Day8 or >= Day7, <= Day7 or >= Day6, <= Day6 or >= Day5, <= Day5 or >= Day4, <= Day4 or >= Day3, <= Day3 or >= Day2, <= Day2 or >= Day1, <= Day1.
What to do about it
- Upgrade to Lara Dashboard version 1.3.0 or later to mitigate the authentication bypass vulnerability.
- Review your application's use of the screenshot-login route and ensure it is not exposed to unauthenticated users.
- Monitor your application logs for any suspicious activity related to the screenshot-login endpoint.
- Consider implementing additional authentication checks for sensitive routes until the upgrade is completed.
How 0Day would have caught this
lara-dashboard is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Lara Dashboard versions before 1.3.0, specifically versions >= v1.2.0, <= v1.2.0 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= Laravel12.x-module-logs, <= Laravel12.x-module-logs or >= Laravel12.x-tailadmin, <= Laravel12.x-tailadmin or >= v11.x-main, <= v11.x-main or >= Laravel11.x, <= Laravel11.x or >= Laravel9.x, <= Laravel9.x or >= Laravel7.x, <= Laravel7.x or >= Day10, <= Day10 or >= Day9, <= Day9 or >= Day8, <= Day8 or >= Day7, <= Day7 or >= Day6, <= Day6 or >= Day5, <= Day5 or >= Day4, <= Day4 or >= Day3, <= Day3 or >= Day2, <= Day2 or >= Day1, <= Day1.
What should I do right now?
Upgrade to Lara Dashboard version 1.3.0 or later to mitigate the authentication bypass vulnerability. Review your application's use of the screenshot-login route and ensure it is not exposed to unauthenticated users. Monitor your application logs for any suspicious activity related to the screenshot-login endpoint. Consider implementing additional authentication checks for sensitive routes until the upgrade is completed.
Is there an official fix available?
Yes, the official fix is to upgrade to Lara Dashboard version 1.3.0 or later.
Has this been exploited in the wild?
No, this vulnerability has not yet been exploited in the wild.