Executive brief
Laravel MagicLink is a library that creates passwordless authentication links and private content access links. The library stored and deserialized user action data without proper integrity checks, allowing an attacker with database write access to inject malicious serialized PHP objects. When a victim clicks a crafted magic link, the application deserializes the malicious object and executes arbitrary code, potentially compromising the entire application.
Technical details
This is a PHP object injection vulnerability in Laravel MagicLink versions 2.0.0 through 2.25.0. The library deserializes action objects stored in the magic_links.action database column using unsafe unserialize() in src/MagicLink.php and src/Actions/ResponseAction.php without cryptographic integrity protection or allowed-class restrictions. An attacker who gains database write access (via SQL injection or compromised credentials) can insert a malicious serialized object graph containing executable PHP closures. When the application processes a magic link containing this payload, the unsafe deserialization instantiates the attacker's object graph and executes arbitrary PHP code within the application process. The vulnerability requires pre-existing database write access but does not provide it independently. Version 2.25.1 removes the legacy unsafe unserialize() fallback and enforces migration to a secure serialization format.
Affected products
- cesargb Laravel MagicLink 2.0.0 to 2.25.0
Timeline
- 2026-09-14: disclosed
- 2026-02-12: patched: Fixed in version 2.25.1