9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23524

CVE-2026-23524: Laravel Redis Horizontal Scaling Insecure Deserialization

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23524

CVE-2026-23524:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
laravel/reverb	composer	< 1.7.0	1.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Laravel Reverb when horizontal scaling is enabled, which uses Redis for Pub/Sub communication between nodes. The advisory states that data from Redis is passed directly to PHP's unserialize() function without any class restrictions, leading to a deserialization of untrusted data vulnerability (CWE-502).

The analysis of the commits associated with the patch confirms this. The commit d7e6637ef665eae978d93f539a67f23c32ede68d in pull request #360 modifies the src/Protocols/Pusher/PusherPubSubIncomingMessageHandler.php file.

Specifically, the handle method within the PusherPubSubIncomingMessageHandler class is changed. The vulnerable code called unserialize() on data received from the event payload ($event['application'] and $event['payload']) without any safeguards.

The patch mitigates this by adding the allowed_classes option to the unserialize() calls, restricting deserialization to a specific set of expected classes (Application, PendingMetric, etc.).

Therefore, the function Laravel\Reverb\Protocols\Pusher\PusherPubSubIncomingMessageHandler::handle is the exact location of the vulnerability. During exploitation, this function would be present in the stack trace as it processes the malicious payload from Redis, making it a key runtime indicator.

Vulnerable functions

Laravel\Reverb\Protocols\Pusher\PusherPubSubIncomingMessageHandler::handle

src/Protocols/Pusher/PusherPubSubIncomingMessageHandler.php

The `handle` function in `PusherPubSubIncomingMessageHandler` processes incoming messages from the Redis PubSub channel. Before the patch, it used PHP's `unserialize()` function on the message payload without restricting the allowed classes. This allows an attacker who can publish messages to the Redis channel to instantiate arbitrary classes, leading to remote code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.