Type Conversion Vulnerability in Spatie URL Signer Security Component
CVE-2026-121589

6.9MEDIUM

Key Information:

Vendor

Spatie

Status
Url-signer
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121589?

A weakness has been discovered in the Spatie URL Signer component, specifically within the AbstractUrlSigner::validate function. This vulnerability arises due to improper handling of the 'expires' argument, leading to incorrect type conversion. Attackers could exploit this flaw remotely, potentially compromising the security of applications using this component. It is crucial to upgrade to version 2.1.4 or later to mitigate this risk. For developers, it is recommended to implement the available patch (commit hash: 86af3355388210668f6bfbe9007bd6545d4942ad) and safeguard your applications.

Affected Version(s)

url-signer 2.1.0

url-signer 2.1.1

url-signer 2.1.2

References

https://vuldb.com/vuln/430430
vdb-entrytechnical-description
https://vuldb.com/vuln/430430/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-121589
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jamshid Himmatov (VulDB User)
VulDB Vulnerability Moderation Team
.