CVE-2026-23524
Unrestricted Deserialization in Laravel Reverb Enables Remote Code Execution
Publication date: 2026-01-21
Last updated on: 2026-03-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| laravel | reverb | to 1.7.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Laravel Reverb versions 1.6.3 and below, where data from the Redis channel is passed directly into PHP's unserialize() function without restricting which classes can be instantiated. This allows an attacker to perform Remote Code Execution (RCE) by exploiting the unserialize process. The risk is higher because Redis servers are often deployed without authentication, but the vulnerability only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).
How can this vulnerability impact me? :
The vulnerability can lead to Remote Code Execution on the server running Laravel Reverb, allowing an attacker to execute arbitrary code remotely. This can compromise the confidentiality, integrity, and availability of the affected system and potentially the entire application environment.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your Laravel Reverb version is 1.6.3 or below and if the environment variable REVERB_SCALING_ENABLED is set to true. Additionally, verify if your Redis server is accessible without authentication. Commands to check the Laravel Reverb version and environment variables depend on your deployment but generally include inspecting your application's composer.lock or package files and environment configuration files. To check Redis accessibility, you can use: `redis-cli ping` to see if Redis responds without authentication, and `redis-cli config get requirepass` to check if a password is set.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Laravel Reverb to version 1.7.0 or later, requiring a strong password for Redis access, ensuring Redis is only accessible via a private network or local loopback, and/or setting the environment variable REVERB_SCALING_ENABLED=false to bypass the vulnerable logic if only one Reverb node is used.