CVE-2026-61701 Details
Description
Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.
A vulnerability exists in Laravel MagicLink versions 2.0.0 through 2.25.1, allowing for insecure deserialization of action objects. The 'magic_links.action' database column stores these serialized objects, which are deserialized without proper integrity checks or class allowlisting. This flaw can be exploited by an attacker with the ability to manipulate database records, such as through SQL injection or compromised admin access, by injecting malicious serialized objects containing executable closures. When the corresponding magic link is accessed, the deserialization occurs, potentially leading to arbitrary code execution within the application.
Users are advised to update to Laravel MagicLink version 2.25.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesargb/laravel-magiclink/commit/19fa820a49ea9b3984e9a91b4bf4bf0cf8375183 | [email protected] | Source CodeVendor |
| https://github.com/cesargb/laravel-magiclink/pull/148 | [email protected] | Source CodeVendor |
| https://github.com/cesargb/laravel-magiclink/releases/tag/v2.25.1 | [email protected] | Release NotesVendor |
| https://github.com/cesargb/laravel-magiclink/security/advisories/GHSA-r33w-fg8j-9c94 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cesargb Laravel MagicLink | >= 2.0.0, < 2.25.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |