Vulnerability · Published Nov 3, 2026 · Assigned by VulDB

CVE-2026-121589spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion

Medium 5.3

In plain English

A medium-severity security flaw in url-signer from spatie. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 63.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.4 is able to address this issue. Patch name: 86af3355388210668f6bfbe9007bd6545d4942ad. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
spatie	url-signer	2.1.02.1.12.1.22.1.3

Weakness: CWE-704 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-430430 | spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion vdb-entry, technical-description
VDB-430430 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-121589 | CVE Analysis and Report third-party-advisory
Submit #1021957 | Spatie url-signer 2.1.3 Denial of Service third-party-advisory
https://github.com/spatie/url-signer/commit/86af3355388210668f6bfbe9007bd6545d4942ad patch
https://github.com/spatie/url-signer/releases/tag/2.1.4 patch
https://github.com/spatie/url-signer/ product