laravel/reverb

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches

This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds

If you cannot upgrade to v1.7.0, you should apply the following mitigations:

• Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.
• Disable Scaling: If your environment uses only one Reverb node, set REVERB_SCALING_ENABLED=false to bypass the vulnerable logic entirely.

Credits

This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact

A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel.

The verification signature is a hash comprised of different parts of the request signed by the app's secret key. The signature is sent as part of the request and should be regenerated by Reverb. Only when both the signature in the request and the one generated by Reverb match should the request be allowed. This helps to verify the request came from a known source.

[!NOTE]
This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker.

The following endpoints were affected:

POST /events
POST /events_batch
GET /connections
GET /channels
GET /channel
GET /channel_users
POST /users_terminate

Patches

The issue was resolved by #252 and the patch released in v1.4.0.

References

Generating Pusher authentication signatures