CVE-2026-121589 json
spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion
published 2026-11-03 5 d ago modified 2026-11-04 5 d ago also EUVD-2026-116618
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.4 is able to address this issue. Patch name: 86af3355388210668f6bfbe9007bd6545d4942ad. It is recommended to upgrade the affected component.
Patch / fix
- spatie url-signer 2.1.4
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- spatie url-signer
Classification
- Weakness
-
- CWE-704 Incorrect Type Conversion or Cast
References
-
github.com
/spatie/url-signer/commit/86af3355388210668f6bfbe9007bd6545d4942ad
patch
-
github.com
/spatie/url-signer/releases/tag/2.1.4
patch
-
vuldb.com
/vuln/430430
vdb-entry, technical-description
-
vuldb.com
/vuln/430430/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-121589
third-party-advisory
-
vuldb.com
/submit/1021957
third-party-advisory
-
github.com
/spatie/url-signer/
product
Sources
- CVE List CVE-2026-121589
- NVD CVE-2026-121589
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.