CVE-2026-61701 is a deserialization of untrusted data vulnerability (CWE-502) in the cesargb laravel-magiclink package. Versions >=2.0.0 and <2.25.1 store serialized action objects in the magic_links.action database column and deserialize them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity checks. An unsafe legacy unserialize() fallback remains reachable, enabling an attacker who can manipulate database records to insert malicious serialized objects containing executable closures. When a user visits the crafted magic link, the application deserializes the malicious object, potentially executing arbitrary code within the application process. The vulnerability requires the attacker to have database write capabilities through other means and does not independently grant such access. The vulnerability is resolved in version 2.25.1.

Successful exploitation allows an attacker with database write access to execute arbitrary code within the application process by injecting malicious serialized objects. This can lead to full compromise of the application, including confidentiality, integrity, and availability impacts. However, the vulnerability does not provide direct database write access and requires a separate vector to manipulate database records.

Upgrade laravel-magiclink to version 2.25.1 or later, where this vulnerability is fixed. Until then, ensure that database write access is tightly controlled and monitor for any unauthorized modifications to the magic_links.action column. Patch status is confirmed fixed in 2.25.1.