CVE-2026-61701: Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.25.1
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Applications using Laravel MagicLink versions 2.0.0 through 2.25.1 are affected if an attacker can manipulate records in the magic_links.action database column and cause a corresponding magic link to be visited.
What access does an attacker need to trigger code execution?
The issue does not itself grant database-write access. An attacker needs a separate way to alter MagicLink action records, such as SQL injection or compromised administrative access, and must insert a malicious serialized object graph into an associated record.
How can I determine whether my application is affected?
Check whether Laravel MagicLink is installed at a version from 2.0.0 through 2.25.1 and whether magic link action records could have been modified through database compromise, SQL injection, or administrative-account compromise. The vulnerable data is stored in the magic_links.action column.
What is the available remediation?
Upgrade Laravel MagicLink to version 2.25.1, which fixes the issue. Also investigate and remove any paths that could allow unauthorized modification of magic_links records.