CVE-2026-61701

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.

• CWE-502

• https://github.com/cesargb/laravel-magiclink/commit/19fa820a49ea9b3984e9a91b4bf4bf0cf8375183
• https://github.com/cesargb/laravel-magiclink/pull/148
• https://github.com/cesargb/laravel-magiclink/releases/tag/v2.25.1
• https://github.com/cesargb/laravel-magiclink/security/advisories/GHSA-r33w-fg8j-9c94

Published

Sep 14, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61694go-xrpl is a Go implementation of the XRP Ledger protocol. I…3.7
• CVE-2026-61695Wire provides gRPC and protocol buffers for Android, Kotlin,…7.5
• CVE-2026-61696Forem is open source software for building communities. In v…6.3
• CVE-2026-61699nebula-mesh is a self-hosted control plane for Slack Nebula …8.1
• CVE-2026-6170The Bold Page Builder plugin for WordPress is vulnerable to …6.4
• CVE-2026-61700MariaDB Connector/J is used to connect applications develope…3.7
• CVE-2026-61702OpenPrinting CUPS is an open source printing system for Linu…5.3
• CVE-2026-61704Link Preview JS extracts web links information. Prior to 4.0…7.5
• CVE-2026-61707SOCFortress CoPilot focuses on providing a single pane of gl…9
• CVE-2026-61708SOCFortress CoPilot focuses on providing a single pane of gl…8.5
• CVE-2026-61709OpenFGA is an authorization and permission engine built for …5.3
• CVE-2026-6171The Bold Page Builder plugin for WordPress is vulnerable to …6.4