PT-2026-3792 · Laravel · Laravel Reverb

M0H4Mmad

·

Published

2026-01-21

·

Updated

2026-01-30

·

CVE-2026-23524

CVSS v3.1
10
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Laravel Reverb versions 1.6.3 and below
Description Laravel Reverb, a real-time WebSocket communication backend for Laravel applications, has an issue where it passes data from the Redis channel directly into PHP’s 
unserialize()
function without restricting which classes can be instantiated. This can lead to Remote Code Execution (RCE). The risk is increased because Redis servers are often deployed without authentication. This issue affects Laravel Reverb when horizontal scaling is enabled (REVERB SCALING ENABLED=true). The 
unserialize()
function is used to convert serialized data back into PHP objects.
Recommendations Laravel Reverb versions 1.6.3 and below: Upgrade to version 1.7.0. Laravel Reverb versions 1.6.3 and below: If upgrading to version 1.7.0 is not possible, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback. Laravel Reverb versions 1.6.3 and below: If upgrading to version 1.7.0 is not possible and the environment uses only one Reverb node, set 
REVERB SCALING ENABLED=false
to bypass the vulnerable logic.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-01045
CVE-2026-23524
GHSA-M27R-M6RX-MHM4

Affected Products

Laravel Reverb