CVE-2026-121589 Details
Description
A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.4 is able to address this issue. Patch name: 86af3355388210668f6bfbe9007bd6545d4942ad. It is recommended to upgrade the affected component.
A vulnerability exists in the Spatie Url-Signer package, specifically in versions through 2.1.3. The issue arises in the AbstractUrlSigner::validate function within AbstractUrlSigner.php, where improper handling of the 'expires' parameter leads to incorrect type conversion. This flaw allows for remote exploitation. The vulnerability has been publicly disclosed, and a patch is available in version 2.1.4.
Users are advised to upgrade to Spatie Url-Signer version 2.1.4, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/spatie/url-signer/ | [email protected] | Vendor |
| https://github.com/spatie/url-signer/commit/86af3355388210668f6bfbe9007bd6545d4942ad | [email protected] | Source CodeVendor |
| https://github.com/spatie/url-signer/releases/tag/2.1.4 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-121589 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1021957 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/430430 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/430430/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-704 | Incorrect Type Conversion or Cast | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| spatie url-signer | <= 2.1.3 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |