CVE-2026-23524: Laravel Reverb remote code execution (CVSS 9.8)

Description

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis channel directly into PHP’s unserialize() function without restricting which classes can be instantiated, which leaves users vulnerable to Remote Code Execution. The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication, but only affects Laravel Reverb when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). This issue has been fixed in version 1.7.0. As a workaround, require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback, and/or set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely (if the environment uses only one Reverb node).

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Laravel Reverb< 1.7.0

Remediation

Fixed in

Laravel Reverb≥ 1.7.0

Patch & vendor advisories

References

https://cwe.mitre.org/data/definitions/502.htmlTechnical Description
https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1aPatch
https://github.com/laravel/reverb/releases/tag/v1.7.0ProductRelease Notes
https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4MitigationVendor Advisory
https://laravel.com/docs/12.x/reverb#scalingTechnical Description

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-23524 being actively exploited?

CVE-2026-23524 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.99%.

How severe is CVE-2026-23524?

CVE-2026-23524 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.99% probability of exploitation.

Which products are affected by CVE-2026-23524?

Affected products include Laravel Reverb.

How do I fix CVE-2026-23524?

Upgrade affected software to a fixed version, for example Laravel Reverb 1.7.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-23524 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo