Laravel Reverb permits deserialization of data received from a Redis channel through PHP’s unserialize() without class restrictions, enabling an attacker to instantiate arbitrary objects that can trigger code execution when horizontal scaling is enabled. The vulnerability is flagged as CWE‑502, reflecting insecure deserialization that can be leveraged to run malicious code on the server. This flaw directly threatens the confidentiality, integrity, and availability of any application that relies on Reverb for real‑time communication, because the attacker can execute arbitrary PHP code with the privileges of the process that runs Reverb.

Applications using Laravel Reverb version 1.6.3 or earlier with REVERB_SCALING_ENABLED set to true are impacted. The issue has been corrected starting with Reverb 1.7.0. It also requires a working Redis instance; the flaw manifests only when horizontal scaling is activated.

The CVSS score of 9.8 classifies it as critical, and the EPSS score of less than 1% indicates low current exploitation probability, although the high severity warrants immediate attention. Exploitation requires access to a Redis instance that is not protected by authentication, which is common in many deployments. Attackers can inject crafted payloads into Redis channels, which are then unserialized by Reverb, resulting in remote code execution. The flaw is not listed in the KEV catalog but its severity and the straightforward attack path make it a high‑risk vulnerability if left unpatched.