CVE-2026-61701

Executive Summary

CVE-2026-61701 is an insecure deserialization vulnerability (CWE-502) in the Laravel MagicLink package affecting versions from 2.0.0 up to, but not including, 2.25.1. The package stores serialized action objects in the magic_links.action database column and deserializes them during magic link processing without adequate integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker with the ability to write to the database (via a separate SQL injection or compromised administrative access) can plant a malicious serialized object graph that, when the associated magic link is visited, yields remote code execution in the application process. Impact is high for confidentiality, integrity, and availability, but the flaw does not itself grant database-write access; it is a chained post-compromise escalation primitive.

Technical Analysis

The vulnerability resides in the Laravel MagicLink package, which provides passwordless authentication and gated access to private content by generating single-use links that map to serialized "action" objects stored in the magic_links.action database column. Processing of these records flows through src/MagicLink.php and src/Actions/ResponseAction.php.

The core weakness is that MagicLink deserializes the stored action payload without sufficient integrity protection. In other words, the application trusts that the bytes in magic_links.action are exactly what it originally wrote. Because no cryptographic signature, MAC, or other tamper-evident binding is enforced on the serialized blob, an actor who can modify that column can substitute an arbitrary serialized object graph. The description further notes that an unsafe legacy unserialize() fallback remains reachable, which broadens the input surface and increases the likelihood that attacker-controlled data reaches the deserializer on code paths that may have been assumed deprecated.

Deserialization of attacker-controlled object graphs is dangerous because PHP's unserialization process can invoke magic methods such as __wakeup() and __destruct(), as well as autoloaded classes, as the object graph is reconstructed. Where the restored graph contains "executable closure behavior," reconstruction can lead directly to code execution within the application process rather than merely corrupting application state. The NVD description explicitly frames this as a malicious serialized object graph that can execute arbitrary code once the associated magic link is visited.

It is important to bound the impact precisely: the affected path is restricted to manipulated action records and does not independently provide database-write access. The vulnerability is therefore not a self-contained unauthenticated RCE against the network listener. It is a deserialization sink that becomes exploitable only when the attacker already holds a database-write primitive or equivalent administrative control. The CVSS vector reflects this: network attack vector (AV:N) with low complexity (AC:L), but low privileges required (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability.

No function names, endpoints, or parameters beyond those present in the NVD description should be inferred. There is no public proof-of-concept, no Nuclei template, and no observed exploit code in circulation for this CVE at the time of writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-502, insecure deserialization) and the explicit prerequisites stated in the NVD description.

1. Reconnaissance and target identification. The attacker identifies an application running the Laravel MagicLink package at a version in the range 2.0.0 through 2.25.0. This is typically confirmed by observing magic-link based authentication or gated private content flows, by fingerprinting the package via dependency manifests where accessible, or by identifying the characteristic database schema (a table containing a magic_links.action column) after gaining database visibility.

2. Establishing a write primitive. Because the flaw does not itself grant database-write access, the attacker must first obtain a way to manipulate database records. The description names two realistic routes: a separate SQL injection vulnerability elsewhere in the application, or compromised administrative access with direct or indirect write capability against the relevant table. Absent one of these primitives, the vulnerability is not reachable.

3. Crafting the malicious serialized object graph. With write access, the attacker replaces the legitimate action payload in the magic_links.action column belonging to a magic link they can (or will) trigger, substituting a serialized object graph of their choosing that contains executable closure behavior. The goal is that when the application later reads and deserializes the record, the unsafe unserialize() fallback and/or the standard deserialization path in src/MagicLink.php and src/Actions/ResponseAction.php reconstructs attacker-influenced objects whose magic methods or embedded closure behavior execute code under the web application's process context.

4. Triggering and execution. The attacker (or a victim whose magic link has been tampered with) visits the affected magic link. During response processing the stored action record is deserialized and the malicious object graph executes, resulting in arbitrary code execution in the application process.

5. Post-exploitation impact. Successful exploitation yields code execution with the privileges of the application process (typically the web/PHP-FPM user). From there the attacker can read application secrets and environment variables, access database credentials and further pivot into the database, establish persistence, move laterally to adjacent services reachable from the host, and exfiltrate sensitive user or session data. The high CIA scores reflect that a deserialization RCE is generally total for the host process.

Defenders should note the chained nature: this CVE is best understood as a privilege-escalation and code-execution multiplier that turns a database-write foothold into full application compromise.

Impact Assessment

The CVSS v3.1 base score is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector: Network (AV:N) — the magic link is visited over the network and the deserialization occurs in the application's normal request path.
• Attack Complexity: Low (AC:L) — once the prerequisites are met, exploiting the deserialization sink requires no special race conditions or environment-specific conditions.
• Privileges Required: Low (PR:L) — the attacker must already hold a database-write primitive or administrative access; this is the key gating factor. This is not an unauthenticated vulnerability.
• User Interaction: None (UI:N) — the description indicates the link visit triggers deserialization; there is no requirement for a separate victim to perform a privileged action beyond the link access inherent to the attack.
• Scope: Unchanged (S:U) — the vulnerable component and the impacted component are the same.
• Confidentiality / Integrity / Availability: High / High / High — code execution in the application process compromises all three.

Business impact: A successful chain yields arbitrary code execution in a component that handles authentication and private-content access, which is among the most sensitive parts of an application. Consequences include theft of credentials and session tokens, unauthorized access to protected content, tampering with authentication state, full read/write exposure of data the application can reach, and potential disruption of availability via process termination or resource exhaustion. Blast radius is bounded by the application process's own privileges and network reach, not the host — but that often still includes the backing database and internal service mesh.

The EPSS score is 0.00762 (approximately the 53.7th percentile), indicating a moderate-to-low likelihood of exploitation in the near term, consistent with the fact that exploitation requires a prior foothold. CISA KEV does not list this CVE, and no public exploit code, PoC, or Nuclei template is available. Organizations should still treat it with high urgency given the authentication-adjacent context and total post-exploitation impact.

Detection Guidance

Because exploitation requires database tampering followed by a magic-link visit, detection should focus on (a) anomalous writes to the magic link action storage, (b) deserialization errors and anomalies in PHP/application logs, and (c) outbound or post-exploitation child-process activity from the web/PHP-FPM worker.

Sigma Rule

title: Suspected Laravel MagicLink Insecure Deserialization Activity (CVE-2026-61701)
id: 8a1b2c3d-4e5f-4a6b-9c7d-1e2f3a4b5c6d
status: experimental
description: Detects indicators of tampering or unsafe deserialization of magic link action payloads in Laravel MagicLink prior to 2.25.1.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61701
author: valtersit.com
date: 2026/01/01
logsource:
  product: webserver
  service: php
detection:
  keywords_action:
    - 'magic_links.action'
    - 'MagicLink'
    - 'ResponseAction'
  keywords_deser:
    - 'unserialize()'
    - ' unserialize'
    - 'Object of class'
    - '__PHP_Incomplete_Class'
    - 'allowed_classes'
    - 'Error at offset'
  condition: keywords_action and keywords_deser
fields:
  - timestamp
  - host
  - message
falsepositives:
  - Legitimate application debugging that logs serialization internals
level: high
tags:
  - attack.t1190
  - cwe.502

YARA Rule

rule CVE_2026_61701_Laravel_MagicLink_Deserialization
{
    meta:
        description = "Detects serialized PHP object graphs referencing MagicLink action deserialization components (CVE-2026-61701)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61701"
        date = "2026-01-01"
        cwe = "CWE-502"
        severity = "high"

    strings:
        $php_ser = "O:" ascii
        $ml1 = "MagicLink" ascii
        $ml2 = "ResponseAction" ascii
        $fallback = "unserialize" ascii
        $susp1 = "__PHP_Incomplete_Class" ascii
        $susp2 = "allowed_classes" ascii
        $closure = "Closure" ascii

    condition:
        $php_ser and (any of ($ml*) or $fallback) and any of ($susp*, $closure)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-61701 Laravel MagicLink magic link access - potential deserialization trigger"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"magic"; http.uri; content:!"|3b|"; threshold:type limit, track by_src, count 1, seconds 60; classtype:web-application-attack; reference:cve,2026-61701; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-61701; sid:202661701; rev:1;)

Elastic Detection

process where process.parent.name in ("php-fpm", "apache2", "httpd", "nginx", "php") and
  (process.name in ("sh", "bash", "cmd.exe", "powershell.exe", "curl", "wget") or
   process.command_line like "*unserialize*" or
   process.command_line like "*php -r*")

Splunk SPL Query

index=web OR index=php_logs
(("magic_links.action" OR "MagicLink" OR "ResponseAction") AND
 ("unserialize" OR "__PHP_Incomplete_Class" OR "Error at offset" OR "allowed_classes" OR "Object of class"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(sourcetype) as sourcetypes values(src_ip) as src_ip by host
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,cve,cve-2026">
  <rule id="202661701" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">unserialize</field>
    <description>CVE-2026-61701 - Laravel MagicLink unsafe deserialization indicator in application log</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,</group>
  </rule>

  <rule id="202661702" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">magic_links\.action</field>
    <field name="message">__PHP_Incomplete_Class|allowed_classes|Error at offset|ResponseAction</field>
    <description>CVE-2026-61701 - Possible tampered MagicLink action payload / deserialization failure</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, OSV, claims a fix; not independently confirmed). No vendor advisory URL or explicit commit was provided in the intelligence feed.

1. Immediate mitigations.

• Upgrade the Laravel MagicLink package to version 2.25.1 or later as the primary action; this is the only stated fix. Because the patch is only a single-source claim, validate the changelog or repository history to confirm the remediation is real before declaring closure.
• Until the upgrade is verified in production, restrict access to any database-write capability that could reach the magic_links.action column: audit and tighten database account privileges so that web application accounts cannot write to authentication/action tables except through required application code paths.
• Treat this as a chained risk: prioritize remediation of any SQL injection vulnerabilities and harden administrative authentication on the same application, since exploitation depends on such a primitive.
• If the package is not strictly required, consider removing it or disabling magic-link based authentication flows until patched.
• Invalidate and rotate existing magic links after upgrading so that any records written by an attacker are not carried forward, and audit the magic_links.action column for records that do not match the application's expected serialization format.

2. Patch / upgrade steps.

• Record the current locked version of the MagicLink package from the dependency lockfile.
• Update the package constraint to >=2.25.1 and run the package manager update process.
• Redeploy and confirm the installed version at runtime.
• Re-run integration tests for magic-link authentication and private-content access to confirm functionality post-upgrade.
• Given the 2/4 patch confidence, verify against the upstream repository that version 2.25.1 actually removes or hardens the integrity protection gap and the legacy unserialize() fallback; if confirmation cannot be obtained, treat the issue as unpatched in your environment and rely on compensating controls.

3. Long-term hardening.

• Eliminate unsafe use of native deserialization for trusted state. Store an integrity-protected representation (for example, a signed payload or an opaque identifier resolving server-side) rather than a raw serialized object in a database column.
• If PHP serialization must be used, enforce allowed_classes restrictions or a safelist so that attacker-influenced object graphs cannot instantiate arbitrary classes or closures.
• Apply a message authentication code (HMAC) or signature to any stored action payload and reject records whose integrity check fails, so database tampering is detected rather than executed.
• Remove legacy fallback code paths entirely; deprecated unserialize() fallbacks frequently become the weakest link.
• Adopt a defense-in-depth posture: parameterized queries everywhere to reduce SQL-injection risk, least-privilege database accounts, structured change auditing on authentication-related tables, and runtime application self-protection or WAF rules that flag serialized-object content in request/database context.
• Monitor for anomalous child processes spawned by web workers, which is a common post-exploitation indicator of a deserialization RCE.

References

• NVD — CVE-2026-61701: https://nvd.nist.gov/vuln/detail/CVE-2026-61701
• CWE-502: Deserialization of Untrusted Data — https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• OSV vulnerability database entry for CVE-2026-61701 (patch claim source, version 2.25.1)
• CISA Known Exploited Vulnerabilities catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (this CVE is not listed as of writing)

Threat actor context: No threat actor campaigns, exploitation-in-the-wild evidence, or public proof-of-concept have been observed or reported for CVE-2026-61701 at the time of this report. The EPSS score of 0.00762 (53.7th percentile) is consistent with a vulnerability that requires an existing foothold rather than being directly wormable or mass-exploited.