CVE-2026-61701

Laravel MagicLink, a package for passwordless authentication and private-content links, stores serialized action objects in the magic_links.action database column and deserializes them via src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, including an unsafe legacy unserialize() fallback. The flaw (CWE-502) is triggered when an attacker who can already manipulate database records—for example through a separate SQL injection or compromised administrative access—inserts a malicious serialized object graph containing executable closure behavior; simply visiting the associated magic link then deserializes the tampered record and can execute arbitrary code in the application process. The vulnerability does not itself grant database-write access, so it primarily serves as a privilege-escalation/RCE step chained after initial database compromise. Applications running MagicLink from 2.0.0 up to (but not including) 2.25.1 are affected, and the issue is fixed in 2.25.1. No public proof of concept exists and no exploitation has been observed in the wild.

What to do: Upgrade Laravel MagicLink to version 2.25.1 or later, which adds integrity protection for stored action records. Audit the magic_links.action column for unexpected or malformed serialized payloads that could indicate a tampering attempt, and review database and admin access logs for unauthorized writes. Since exploitation chains off SQL injection or compromised credentials, verify the application is free of injectable queries, restrict database accounts to least privilege, and rotate any credentials with write access to the magic_links table.