The vulnerability arises from the PHP library Saloon's use of PHP's unserialize() function within the AccessTokenAuthenticator::unserialize() method, which allows all classes during deserialization. This insecure deserialization permits an attacker to inject a crafted serialized payload that results in object injection. By supplying a gadget object, the PHP engine will instantiate the object and execute its magic methods, such as __wakeup or __destruct. In a typical configuration where common dependencies like Monolog are present, this chain can yield remote code execution on the system where the library is running.

The affected vendor is SaloonPHP and the product is the Saloon PHP library. Versions older than 4.0.0, which precede the library's removal of native serialization, are impacted. Any application that uses these legacy versions for OAuth token persistence or recovery is at risk.

The CVSS score of 8.1 indicates a high severity issue, and the low EPSS score (<1%) suggests that widespread exploitation is unlikely at present, yet the potential consequences are severe. Because the flaw relies on an attacker’s ability to supply a crafted serialized string—either by overwriting cached token files or via another injection vector—the threat model is most acute for systems that expose local token storage to user input or where attackers can compromise the application’s file system. The vulnerability is not listed in CISA's KEV catalog, but the high impact warrants immediate mitigation.