Loading...
Skip to main content
GeekWala

CVE-2026-61701 — Vulnerability in cesargb/laravel-magiclink — CVE...

HIGH

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Published February 12, 2026Updated September 15, 2026Source: osv

Summary

## Description MagicLink stores serialized action objects in the `magic_links.action` database column and deserializes them without integrity validation or class allowlisting in [src/MagicLink.php](src/MagicLink.php#L59-L77) and [src/Actions/ResponseAction.php](src/Actions/ResponseAction.php#L64-L77). An attacker with the ability to manipulate database records (e.g., via SQL injection or compromised admin access) could inject malicious serialized objects containing arbitrary closures, leading to Remote Code Execution (RCE) when the magic link is visited. ## Resolution The vulnerability has been mitigated through HMAC-signed serialization using the application key, class allowlisting restricted to `ActionAbstract` subclasses and framework classes, strict type validation preventing arbitrary object storage, and backward compatibility support for legacy data via `allowed_classes` in `unserialize()`. Implementation includes a new [Serializable](src/Security/Serializable/Serializable.php) security class with signing/verification, refactored getter/setter methods in MagicLink.

Advisory Timeline

  • First published February 12, 2026 (242 days ago).
  • Last revised September 15, 2026 — 214 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update cesargb/laravel-magiclink to 2.25.1 or later
composer require "cesargb/laravel-magiclink:^2.25.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
cesargb/laravel-magiclink
packagist
v2.0.0, v2.1.0, v2.10.0, v2.10.1 (+44 more)2.25.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-61701?
MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-61701?
CVE-2026-61701 affects cesargb/laravel-magiclink. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-61701 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-r33w-fg8j-9c94

Related CVEs

  • CVE-2026-65954
    HIGH

    PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

  • CVE-2026-61825
    HIGH

    code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies