Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61701— Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Quick assessment

Affected
cesargb laravel-magiclink
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Laravel MagicLink 用于生成用于身份验证或访问私有内容的链接（无需密码）。从 2.0.0 到 2.25.1 版本中，MagicLink 将序列化后的 action 对象存储在 数据库列中，并通过 和 进行反序列化，但缺乏足够的完整性保护机制，同时仍然保留了一个不安全的历史 回退路径。 如果攻击者能够操控数据库记录（例如通过单独的 SQL 注入或已获得的管理员访问权限被攻破），他们就可以插入包含可执行闭包行为的恶意序列化对象图。当访问相应的 magic link 时，系统会反序列化该记录，从而在应用进

CVSS 8.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
cesargb laravel-magiclink >= 2.0.0, < 2.25.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61701

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
Source: CVE Program / CVE List V5
Vulnerability Description
Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cesargb laravel-magiclink >= 2.0.0, < 2.25.1 -

II. Public POCs for CVE-2026-61701

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61701

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61701 (2)

Vendor Advisories for CVE-2026-61701 (1)

Vendor Pages for CVE-2026-61701 (1)

IV. Related Vulnerabilities

Same weakness: CWE-502

V. Comments for CVE-2026-61701

No comments yet

Leave a comment