PT-2026-28182 · Saloon+2 · Saloon+2

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33942

Positive Technologies · (AI Summary)

CVSS v4.0

8.1

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Saloon versions prior to 4.0.0

Description Saloon is a PHP library used for building API integrations and SDKs. The library used PHP's unserialize() function in the AccessTokenAuthenticator::unserialize() method, with allowed classes set to true, to restore OAuth token state. This allowed an attacker who could control the serialized string to supply a serialized "gadget" object. When unserialize() was executed, PHP instantiated the object and ran its magic methods, potentially leading to object injection. In environments with common dependencies like Monolog, this could be chained to achieve remote code execution (RCE).

Recommendations Update to version 4.0.0 or later, which removes PHP serialization from the AccessTokenAuthenticator class, requiring manual storage and resolution of the authenticator.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-33942

Affected Products

Monolog

Php

Saloon

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33942 · Security Note
• https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 · Note
• https://twitter.com/cyberbivash/status/2036999562720616459 · Twitter Post
• https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9 · Note