CVE-2026-33942 - Vulnerability Analysis

Overview

Saloon < 4.0.0 contains an insecure deserialization vulnerability caused by use of PHP's unserialize() with allowed_classes=true in AccessTokenAuthenticator::unserialize(), letting attackers supply crafted serialized objects leading to remote code execution, exploit requires attacker control over serialized input.

Severity & Score

Impact

Attackers controlling serialized input can achieve remote code execution, potentially compromising the entire system.

Mitigation

Update to version 4.0.0 or later which removes PHP serialization in AccessTokenAuthenticator.

References

• https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4
• https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner