CVE-2026-61701

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.

• CWE-502

• https://github.com/cesargb/laravel-magiclink/commit/19fa820a49ea9b3984e9a91b4bf4bf0cf8375183
• https://github.com/cesargb/laravel-magiclink/pull/148
• https://github.com/cesargb/laravel-magiclink/releases/tag/v2.25.1
• https://github.com/cesargb/laravel-magiclink/security/advisories/GHSA-r33w-fg8j-9c94

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61688SolidInvoice is an open-source invoicing platform. Prior to …6.5
• CVE-2026-6169The affiliate-toolkit plugin for WordPress is vulnerable to …7.2
• CVE-2026-61690Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipA…6.5
• CVE-2026-61692Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61696Forem is open source software for building communities. In v…6.3
• CVE-2026-61699nebula-mesh is a self-hosted control plane for Slack Nebula …8.1
• CVE-2026-61704Link Preview JS extracts web links information. Prior to 4.0…7.5
• CVE-2026-61709OpenFGA is an authorization and permission engine built for …5.3
• CVE-2026-61710Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61711BuildKit is a toolkit for converting source code to build ar…5.3
• CVE-2026-61712BuildKit is a toolkit for converting source code to build ar…2.3
• CVE-2026-61718bunkerweb is an Open-source and next-generation Web Applicat…5.4