CVE-2026-23524

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23524", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.980Z", "datePublished": "2026-01-21T22:07:55.682Z", "dateUpdated": "2026-01-22T16:49:37.182Z"}, "containers": {"cna": {"title": "Laravel Redis Horizontal Scaling Insecure Deserialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4"}, {"name": "https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a", "tags": ["x_refsource_MISC"], "url": "https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a"}, {"name": "https://cwe.mitre.org/data/definitions/502.html", "tags": ["x_refsource_MISC"], "url": "https://cwe.mitre.org/data/definitions/502.html"}, {"name": "https://github.com/laravel/reverb/releases/tag/v1.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/laravel/reverb/releases/tag/v1.7.0"}, {"name": "https://laravel.com/docs/12.x/reverb#scaling", "tags": ["x_refsource_MISC"], "url": "https://laravel.com/docs/12.x/reverb#scaling"}], "affected": [{"vendor": "laravel", "product": "reverb", "versions": [{"version": "< 1.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T22:07:55.682Z"}, "descriptions": [{"lang": "en", "value": "Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP\u2019s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node)."}], "source": {"advisory": "GHSA-m27r-m6rx-mhm4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:13:34.417400Z", "id": "CVE-2026-23524", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:49:37.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23524", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T15:13:34.417400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:13:35.611Z"}}], "cna": {"title": "Laravel Redis Horizontal Scaling Insecure Deserialization", "source": {"advisory": "GHSA-m27r-m6rx-mhm4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "laravel", "product": "reverb", "versions": [{"status": "affected", "version": "< 1.7.0"}]}], "references": [{"url": "https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4", "name": "https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a", "name": "https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a", "tags": ["x_refsource_MISC"]}, {"url": "https://cwe.mitre.org/data/definitions/502.html", "name": "https://cwe.mitre.org/data/definitions/502.html", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/laravel/reverb/releases/tag/v1.7.0", "name": "https://github.com/laravel/reverb/releases/tag/v1.7.0", "tags": ["x_refsource_MISC"]}, {"url": "https://laravel.com/docs/12.x/reverb#scaling", "name": "https://laravel.com/docs/12.x/reverb#scaling", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP\u2019s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T22:07:55.682Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23524", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:49:37.182Z", "dateReserved": "2026-01-13T18:22:43.980Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T22:07:55.682Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "reverb", "vendor": "laravel", "versions": [{"status": "affected", "version": "< 1.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:laravel:reverb:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC0C178D-8618-4963-8AB2-75B260023D0A", "versionEndExcluding": "1.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP\u2019s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node)."}, {"lang": "es", "value": "Laravel Reverb proporciona un backend de comunicaci\u00f3n WebSocket en tiempo real para aplicaciones Laravel. En las versiones 1.6.3 e inferiores, Reverb pasa datos del canal Redis directamente a la funci\u00f3n unserialize() de PHP sin restringir qu\u00e9 clases pueden ser instanciadas, lo que deja a los usuarios vulnerables a la ejecuci\u00f3n remota de c\u00f3digo. La explotabilidad de esta vulnerabilidad se incrementa porque los servidores Redis se implementan com\u00fanmente sin autenticaci\u00f3n, pero solo afecta a Laravel Reverb cuando el escalado horizontal est\u00e1 habilitado (REVERB_SCALING_ENABLED=true). Este problema ha sido solucionado en la versi\u00f3n 1.7.0. Como soluci\u00f3n alternativa, requiera una contrase\u00f1a fuerte para el acceso a Redis y aseg\u00farese de que el servicio solo sea accesible a trav\u00e9s de una red privada o loopback local, y/o configure REVERB_SCALING_ENABLED=false para eludir completamente la l\u00f3gica vulnerable (si el entorno utiliza solo un nodo Reverb)."}], "id": "CVE-2026-23524", "lastModified": "2026-06-17T10:21:43.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23524", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T15:13:34.417400Z", "version": "2.0.3"}}]}, "published": "2026-01-21T22:15:50.280", "references": [{"source": "security-advisories@github.com", "tags": ["Technical Description"], "url": "https://cwe.mitre.org/data/definitions/502.html"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/laravel/reverb/releases/tag/v1.7.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4"}, {"source": "security-advisories@github.com", "tags": ["Technical Description"], "url": "https://laravel.com/docs/12.x/reverb#scaling"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:07:01.361850+00:00", "value": {"mitigation_remediation": ["Upgrade Laravel Reverb to version 1.7.0 or later where the vulnerable logic has been removed.", "If an upgrade is not feasible, disable horizontal scaling by setting REVERB_SCALING_ENABLED=false to bypass the unsafe deserialization path entirely.", "Apply strong authentication to the Redis server and restrict its network exposure to a private subnet or loopback interface to prevent unauthenticated access to the channel data."], "summary": {"action": "Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Applications using Laravel Reverb version 1.6.3 or earlier with REVERB_SCALING_ENABLED set to true are impacted. The issue has been corrected starting with Reverb 1.7.0. It also requires a working Redis instance; the flaw manifests only when horizontal scaling is activated.", "description_and_impact": "Laravel Reverb permits deserialization of data received from a Redis channel through PHP\u2019s unserialize() without class restrictions, enabling an attacker to instantiate arbitrary objects that can trigger code execution when horizontal scaling is enabled. The vulnerability is flagged as CWE\u2011502, reflecting insecure deserialization that can be leveraged to run malicious code on the server. This flaw directly threatens the confidentiality, integrity, and availability of any application that relies on Reverb for real\u2011time communication, because the attacker can execute arbitrary PHP code with the privileges of the process that runs Reverb.", "risk_and_exploitability": "The CVSS score of 9.8 classifies it as critical, and the EPSS score of less than 1% indicates low current exploitation probability, although the high severity warrants immediate attention. Exploitation requires access to a Redis instance that is not protected by authentication, which is common in many deployments. Attackers can inject crafted payloads into Redis channels, which are then unserialized by Reverb, resulting in remote code execution. The flaw is not listed in the KEV catalog but its severity and the straightforward attack path make it a high\u2011risk vulnerability if left unpatched."}}}}, "created": "2026-01-22T10:08:28.790808+00:00", "updated": "2026-04-18T04:15:05.873451+00:00", "vendors": ["laravel", "laravel$PRODUCT$reverb"]}