PT-2026-28160 · Saloon · Saloon

Huajihd · Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-33182

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Saloon versions prior to 4.0.0

Description Saloon is a PHP library used for building API integrations and SDKs. A flaw exists where the library combines a connector's base URL with a request endpoint. If the endpoint is a valid absolute URL, Saloon uses that URL directly, bypassing the base URL and any associated authentication mechanisms. This allows attackers to potentially perform server-side request forgery (SSRF) and leak credentials to a host they control if the endpoint is influenced by user input or configuration parameters like redirect uri or callback URL. The URLHelper::join() function does not validate the endpoint, leading to this behavior.

Recommendations Upgrade to Saloon version 4.0.0 or later.

Exploit

Fix

SSRF

Insufficiently Protected Credentials

Weakness Enumeration

CWE-918

CWE-522

Related Identifiers

CVE-2026-33182

GHSA-C83F-3XP6-HFCP

Affected Products

Saloon

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33182.json · Exploit
• https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c83f-3xp6-hfcp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33182 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33182 · Vendor Advisory
• https://github.com/saloonphp/saloon · Note
• https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 · Note
• https://twitter.com/cyberbivash/status/2036999647642677295 · Twitter Post
• https://twitter.com/CVEnew/status/2037137767172321539 · Twitter Post