Saloonphp Saloon vulnerabilities

CVE-2026-33942 [CRITICAL] CWE-502 CVE-2026-33942: Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file o

CVE-2026-33183 [CRITICAL] CWE-22 CVE-2026-33183: Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read

CVE-2026-33182 [HIGH] CWE-522 CVE-2026-33182: Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies