CVE-2026-54856

Summary

The RexCoin application up to version 1.2.6 contains an unauthenticated PHP Object Injection vulnerability (CWE-502), allowing attackers to deserialize arbitrary objects without authentication, potentially leading to remote code execution or other severe impacts due to unsafe deserialization of user-controlled data.

Exploitability

Exploitation is highly trivial as it requires no authentication, no user interaction, and exploits the default PHP deserialization behavior over the network.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across any environment where RexCoin <= 1.2.6 is deployed and exposed.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to RexCoin version 1.2.7 or later, which contains a fix for the PHP Object Injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.