Saloon has insecure deserialization in AccessTokenAuthenticator
Impact
Users of the OAuth2 utilities in Saloon, specifically the AccessTokenAuthenticator class.
Patches
Upgrade to Saloon v4+
Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4
Description
The Saloon PHP library used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized "gadget" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually.
Credits
Saloon thanks @HuajiHD for finding the issue and recommending solutions and @jonpurvis for applying the fix.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | saloonphp/saloon | < 4.0.0 | 4.0.0 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-502- Platform
- Composer
- Package
saloonphp/saloon- Disclosed
- 27.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rf88-776r-rcq9 - CC BY 4.0
Vulnerability history: saloonphp/saloon
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 03.2026 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
Disclosures per year
- 2026: 3
-
Saloon has insecure deserialization in AccessTokenAuthenticator this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.