PHP · Releases
Laravel v12.69.0 tightens exception page and cookie authentication
Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored cookie before authenticating the user.
Both fixes come from contributor Mior Muhammad Zaki (crynobone).
Laravel has published release v12.69.0 for its 12.x branch, contributed by Mior Muhammad Zaki (crynobone).
First, HTML rendering is now disabled by default in the tooltip of the Laravel exception page (pull request #61381). This reduces the risk of injected markup being rendered in error output.
Second, the framework now checks that the password hash matches the value stored in the remember-me cookie before authenticating the user (#61386). This closes a gap where a stale or manipulated cookie could authenticate a session against an outdated credential state.
Applications on 12.x should update via Composer as usual.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.