AIKIDO-2026-492386
jayanta/laravel-threat-detection is vulnerable to Cleartext Storage of Sensitive Information
65
Medium Risk
This Affects:
jayanta/laravel-threat-detectionTL;DR
The request scanner runs json_encode on each form field before pattern matching, so credential patterns written for the wire form (password=...) never match the encoded shape ({"password":"..."}) and redaction keyed on those labels never runs. Any request that also matches a threat pattern stores password, token, or card values in cleartext in the threat_logs table, and a query string credential is stored in the url column too. Authenticated users of the host application can read those rows from the dashboard, the database, and the REST API for the whole retention period. The fix masks configured credential field names before encoding, whether or not a detection fired.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jayanta/laravel-threat-detection is vulnerable to Cleartext Storage of Sensitive Information in versions 0.0.1 - 1.7.2.
How to fix this
Upgrade the jayanta/laravel-threat-detection library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.