Back github.com

Google Maps Issues 123

github.com • October 5, 2026

The library defaults SSL verification to FALSE when no explicit config is set. The Google Maps API key is appended as a URL query parameter, so both the API key and all request/response data are transmitted over unverified TLS by default.

src/WebService.php:267-269 :

API key sent as URL parameter (line 330):

SSL option applied (line 362):

Google Maps API key exposed as URL parameter over unverified TLS

MITM attacker can intercept the key and make unauthorized API calls at victim's expense

All Google Maps API response data visible to MITM

Change default from FALSE to TRUE:

CVSS 3.1: 7.4 (HIGH) — AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-295 : Improper Certificate Validation

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-105222 Exposes Google Maps API Keys The alexpechkarev/google-maps Laravel package, through version 12.16, disables TLS certificate verification by default, allowing on-path attackers to intercept web-service requests. This vulnerability can expose Google Maps API keys and enable unauthorized API usage, leading to unexpected costs or misleading functionality. Laravel applications using this package are particularly at risk, especially in environments where outbound traffic can be intercepted. The CVE-2026-105222 has a CVSS score of 9.1, marking it as. No proof-of-concept or exploitation in the wild has been confirmed yet, but immediate remediation is advised. Developers are urged to upgrade to a version that enables certificate verification and to review their API key usage. 1 sources 79

Google Maps Issues 123

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)