What is the CVSS score of CVE-2026-27637?

CVE-2026-27637 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Laravel are affected by CVE-2026-27637?

FreeScout versions prior to 1.8.206 contain a critical authentication bypass vulnerability that allows attackers to forge valid user session tokens using predictable MD5 hashing.. A patch is available.

Is there a public PoC exploit available for CVE-2026-27637?

Yes, a public proof-of-concept exploit is available for CVE-2026-27637. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-27637?

Within 24 hours: Identify all FreeScout installations and their versions; isolate or disable public-facing instances running versions before 1.8.206. Within 7 days: Apply vendor patch to version 1.8.206 or later across all FreeScout deployments; conduct authentication logs review for suspicious token usage. Within 30 days: Rotate all user credentials and session tokens post-patching; implement enhanced logging and monitoring for authentication anomalies; assess whether customer or internal data was accessed during vulnerability window.

Laravel CVE-2026-27637

CRITICAL

Use of Insufficiently Random Values (CWE-330)

2026-02-25 security-advisories@github.com

Laravel Freescout

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 16:08 vuln.today

Public exploit code

Patch released

Feb 26, 2026 - 16:08 nvd

Patch available

CVE Published

Feb 25, 2026 - 04:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's TokenAuth middleware uses a predictable authentication token computed as MD5(user_id + created_at + APP_KEY). This token is static (never expires/rotates), and if an attacker obtains the APP_KEY - a well-documented and common exposure vector in Laravel applications - they can compute a valid token for any user, including the administrator, achieving full account takeover without any password. This vulnerability can be exploited on its own or in combination with CVE-2026-27636. Version 1.8.206 fixes both vulnerabilities.

AnalysisAI

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers to predict reset tokens and take over accounts. PoC and patch available.

Technical ContextAI

CWE-330 weak PRNG for password reset token generation. Tokens can be predicted, enabling account takeover through password reset.

RemediationAI

Update to FreeScout 1.8.206. Use cryptographically secure random token generation.

More in Laravel

View all

CVE-2017-16894 HIGH Act Now POC

7.5 Nov 20

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo

CVE-2025-54068 CRITICAL Act Now POC

9.8 Jul 17

Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th

CVE-2025-53833 CRITICAL Act Now POC

10.0 Jul 14

LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C

CVE-2026-28289 CRITICAL Act Now POC

10.0 Mar 03

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

8.8 Feb 25

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2018-15133 HIGH Act Now POC

8.1 Aug 09

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

CVE-2025-70841 CRITICAL Act Now POC

10.0 Feb 03

Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai

CVE-2026-21448 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address

CVE-2026-21446 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth

CVE-2022-2870 CRITICAL Act Now POC

9.8 Aug 17

A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera

CVE-2026-21449 HIGH This Week POC

8.8 Jan 02

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f

CVE-2022-2886 HIGH This Week POC

8.8 Aug 19

A vulnerability, which was classified as critical, was found in Laravel 5.1. Rated high severity (CVSS 8.8), this vulner

Same weakness CWE-330 – Use of Insufficiently Random Values

View all

CVE-2017-6026 CRITICAL POC

9.1

CVE-2022-36536 CRITICAL POC

9.8

CVE-2022-44938 CRITICAL POC

9.8

CVE-2022-22922 CRITICAL POC

9.8

CVE-2021-41694 CRITICAL POC

9.8

CVE-2021-28024 CRITICAL POC

9.8

CVE-2021-27200 CRITICAL POC

9.8

CVE-2019-15130 CRITICAL POC

9.8

CVE-2026-27637 vulnerability details – vuln.today

Back

Laravel CVE-2026-27637

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Laravel

Same weakness CWE-330 – Use of Insufficiently Random Values

Share

External POC / Exploit Code