Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33942: Saloon library can run attacker code via token cache

CVE-2026-33942 · published 7 months ago

Summary

The Saloon PHP library versions before 4.0.0 use an unsafe method to restore OAuth tokens, allowing a crafted token file to execute code on the server. If an attacker can modify the cached token, they could run commands and take control of the system. Upgrade to version 4.0.0 or later, which removes this unsafe behavior, and ensure token files are stored in a location that only trusted processes can write.

What to do

Update saloonphp saloon to version 4.0.0.
Update saloonphp saloonphp/saloon to version 4.0.0.
Update saloon saloon to version 4.0.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	saloon	saloon	< 4.0.0 `cpe:2.3:a:saloon:saloon::::::::`
composer	saloonphp	saloon	< 4.0.0 Fix: upgrade to 4.0.0
Packagist	saloonphp	saloonphp/saloon	< 4.0.0 Fix: upgrade to 4.0.0

Original advisory text

Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized "gadget" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix in version 4.0.0 removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually.

References

https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 URL
https://github.com/saloonphp/saloon/security/advisories/GHSA-rf88-776r-rcq9 Vendor Advisory
https://github.com/advisories/GHSA-rf88-776r-rcq9
https://github.com/saloonphp/saloon Product
https://nvd.nist.gov/vuln/detail/CVE-2026-33942 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33942... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published26 Mar 2026

Updated4 Nov 2026

First seen26 Mar 2026

Sources

CVE-2026-33942 · NVD

GHSA-rf88-776r-rcq9 · GHSA

GHSA-rf88-776r-rcq9 · OSV

CVE-2026-33942 · OSV

Track software like this

Free during beta