CVE-2026-33942 - Vulnerability Analysis

Overview

Saloon < 4.0.0 contains an insecure deserialization vulnerability caused by use of PHP's unserialize() with allowed_classes=true in AccessTokenAuthenticator::unserialize(), letting attackers supply crafted serialized objects leading to remote code execution, exploit requires attacker control over serialized input.

Severity & Score

Impact

Attackers controlling serialized input can achieve remote code execution, potentially compromising the entire system.

Mitigation

Update to version 4.0.0 or later which removes PHP serialization in AccessTokenAuthenticator.

References

• https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9
• https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🔴 CVE-2026-33942 - Critical (9.8) Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33942/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner