{"ecosystem":"composer","package":"laravel/framework","version":null,"bugs":[{"id":51,"ecosystem":"composer","package_name":"laravel/framework","affected_version":"11.0.0","fixed_version":"11.0.5","bug_id":"github:#50182","title":"Broadcast channel authorization bypass with wildcard routes","description":"Broadcasting::channel() with wildcard placeholders (`*`) matched any channel, bypassing auth callbacks. Fixed in 11.0.5.","severity":"high","status":"closed","source":"github_issues","source_url":"https://github.com/laravel/framework/issues/50182","labels":["bug","security","broadcasting"],"created_at":"2026-04-19 03:37:14.156677+00:00","updated_at":"2026-04-19 03:37:14.156677+00:00"}],"total":1,"_cache":"hit"}