CVE-2026-33942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33942", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T19:50:52.104Z", "datePublished": "2026-03-26T00:27:23.776Z", "dateUpdated": "2026-03-28T02:06:07.913Z"}, "containers": {"cna": {"title": "Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9"}, {"name": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "tags": ["x_refsource_MISC"], "url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"}], "affected": [{"vendor": "saloonphp", "product": "saloon", "versions": [{"version": "< 4.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T00:27:23.776Z"}, "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized \"gadget\" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix in version 4.0.0 removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually."}], "source": {"advisory": "GHSA-rf88-776r-rcq9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-28T02:05:34.371101Z", "id": "CVE-2026-33942", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-28T02:06:07.913Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-28T02:05:34.371101Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-28T02:06:03.610Z"}}], "cna": {"title": "Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)", "source": {"advisory": "GHSA-rf88-776r-rcq9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "saloonphp", "product": "saloon", "versions": [{"status": "affected", "version": "< 4.0.0"}]}], "references": [{"url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9", "name": "https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "name": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized \"gadget\" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix in version 4.0.0 removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T00:27:23.776Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33942", "state": "PUBLISHED", "dateUpdated": "2026-03-28T02:06:07.913Z", "dateReserved": "2026-03-24T19:50:52.104Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T00:27:23.776Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "saloon", "vendor": "saloonphp", "versions": [{"status": "affected", "version": "< 4.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saloon:saloon:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DA20E08-DBB0-4ACD-BED9-550F3ED97E3D", "versionEndExcluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized \"gadget\" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix in version 4.0.0 removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually."}, {"lang": "es", "value": "Saloon es una biblioteca PHP que proporciona a los usuarios herramientas para construir integraciones de API y SDKs. Las versiones anteriores a la 4.0.0 utilizaban la funci\u00f3n unserialize() de PHP en AccessTokenAuthenticator::unserialize() para restaurar el estado del token OAuth desde la cach\u00e9 o el almacenamiento, con allowed_classes =&gt; true. Un atacante que puede controlar la cadena serializada (por ejemplo, sobrescribiendo un archivo de token en cach\u00e9 o mediante otra inyecci\u00f3n) puede proporcionar un objeto 'gadget' serializado. Cuando se ejecuta unserialize(), PHP instancia ese objeto y ejecuta sus m\u00e9todos m\u00e1gicos (__wakeup, __destruct, etc.), lo que lleva a la inyecci\u00f3n de objetos. En entornos con dependencias comunes (por ejemplo, Monolog), esto puede encadenarse a la ejecuci\u00f3n remota de c\u00f3digo (RCE). La correcci\u00f3n en la versi\u00f3n 4.0.0 elimina la serializaci\u00f3n de PHP de la clase AccessTokenAuthenticator, lo que requiere que los usuarios almacenen y resuelvan el autenticador manualmente."}], "id": "CVE-2026-33942", "lastModified": "2026-06-17T10:38:20.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33942", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-28T02:05:34.371101Z", "version": "2.0.3"}}]}, "published": "2026-03-26T01:16:28.040", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "saloon", "source": "cna", "vendor": "saloonphp"}, "product": "saloon", "vendor": "saloonphp"}], "analysis": {"en": {"generated_at": "2026-03-26T21:30:12.861843+00:00", "value": {"mitigation_remediation": ["Upgrade the Saloon library to version 4.0.0 or later."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected vendor is SaloonPHP and the product is the Saloon PHP library. Versions older than 4.0.0, which precede the library's removal of native serialization, are impacted. Any application that uses these legacy versions for OAuth token persistence or recovery is at risk.", "description_and_impact": "The vulnerability arises from the PHP library Saloon's use of PHP's unserialize() function within the AccessTokenAuthenticator::unserialize() method, which allows all classes during deserialization. This insecure deserialization permits an attacker to inject a crafted serialized payload that results in object injection. By supplying a gadget object, the PHP engine will instantiate the object and execute its magic methods, such as __wakeup or __destruct. In a typical configuration where common dependencies like Monolog are present, this chain can yield remote code execution on the system where the library is running.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity issue, and the low EPSS score (<1%) suggests that widespread exploitation is unlikely at present, yet the potential consequences are severe. Because the flaw relies on an attacker\u2019s ability to supply a crafted serialized string\u2014either by overwriting cached token files or via another injection vector\u2014the threat model is most acute for systems that expose local token storage to user input or where attackers can compromise the application\u2019s file system. The vulnerability is not listed in CISA's KEV catalog, but the high impact warrants immediate mitigation."}}}}, "created": "2026-03-26T11:30:54.809401+00:00", "updated": "2026-03-27T09:29:00.380313+00:00", "vendors": ["saloonphp", "saloonphp$PRODUCT$saloon"]}