diff --git a/plugins/multifactorauth/webauthn/src/Extension/Webauthn.php b/plugins/multifactorauth/webauthn/src/Extension/Webauthn.php
index e1604ae8dcbcd..e899974d9c45f 100644
--- a/plugins/multifactorauth/webauthn/src/Extension/Webauthn.php
+++ b/plugins/multifactorauth/webauthn/src/Extension/Webauthn.php
@@ -323,7 +323,7 @@ public function onUserMultifactorCaptive(Captive $event): void
             }
 
             $serializedOptions = base64_decode($pkOptionsEncoded);
-            $pkOptions         = unserialize($serializedOptions);
+            $pkOptions         = unserialize($serializedOptions, ['allowed_classes' => [PublicKeyCredentialRequestOptions::class]]);
 
             if (!\is_object($pkOptions) || empty($pkOptions) || !($pkOptions instanceof PublicKeyCredentialRequestOptions)) {
                 throw new \RuntimeException('The pending key request is corrupt; a new one will be created');
diff --git a/plugins/multifactorauth/webauthn/src/Helper/Credentials.php b/plugins/multifactorauth/webauthn/src/Helper/Credentials.php
index 94444a801cd99..8a81e38cfd12c 100644
--- a/plugins/multifactorauth/webauthn/src/Helper/Credentials.php
+++ b/plugins/multifactorauth/webauthn/src/Helper/Credentials.php
@@ -104,7 +104,7 @@ public static function verifyAttestation(string $data): ?PublicKeyCredentialSour
         }
 
         try {
-            $publicKeyCredentialCreationOptions = unserialize(base64_decode($encodedOptions));
+            $publicKeyCredentialCreationOptions = unserialize(base64_decode($encodedOptions), ['allowed_classes' => [PublicKeyCredentialCreationOptions::class]]);
         } catch (\Exception) {
             $publicKeyCredentialCreationOptions = null;
         }
@@ -203,7 +203,7 @@ public static function verifyAssertion(string $response): void
 
         // Make sure the public key credential request options in the session are valid
         $serializedOptions                 = base64_decode($encodedPkOptions);
-        $publicKeyCredentialRequestOptions = unserialize($serializedOptions);
+        $publicKeyCredentialRequestOptions = unserialize($serializedOptions, ['allowed_classes' => [PublicKeyCredentialRequestOptions::class]]);
 
         if (
             !\is_object($publicKeyCredentialRequestOptions)
diff --git a/plugins/system/webauthn/src/Authentication.php b/plugins/system/webauthn/src/Authentication.php
index fc06b4c60286c..f2823851ece7a 100644
--- a/plugins/system/webauthn/src/Authentication.php
+++ b/plugins/system/webauthn/src/Authentication.php
@@ -250,7 +250,7 @@ public function validateAssertionResponse(string $data, User $user): PublicKeyCr
         // Make sure the public key credential request options in the session are valid
         $encodedPkOptions                  = $this->session->get('plg_system_webauthn.publicKeyCredentialRequestOptions', null);
         $serializedOptions                 = base64_decode($encodedPkOptions);
-        $publicKeyCredentialRequestOptions = unserialize($serializedOptions);
+        $publicKeyCredentialRequestOptions = unserialize($serializedOptions, ['allowed_classes' => [PublicKeyCredentialRequestOptions::class]]);
 
         if (
             !\is_object($publicKeyCredentialRequestOptions)
@@ -307,7 +307,7 @@ public function validateAttestationResponse(string $data): PublicKeyCredentialSo
 
         /** @var PublicKeyCredentialCreationOptions|null $publicKeyCredentialCreationOptions */
         try {
-            $publicKeyCredentialCreationOptions = unserialize(base64_decode($encodedOptions));
+            $publicKeyCredentialCreationOptions = unserialize(base64_decode($encodedOptions), ['allowed_classes' => [PublicKeyCredentialCreationOptions::class]]);
         } catch (\Exception) {
             Log::add('The plg_system_webauthn.publicKeyCredentialCreationOptions in the session is invalid', Log::NOTICE, 'webauthn.system');
             $publicKeyCredentialCreationOptions = null;
@@ -501,7 +501,7 @@ private function getPKCredentialRequestOptions(): PublicKeyCredentialRequestOpti
         }
 
         try {
-            $publicKeyCredentialRequestOptions = unserialize(base64_decode($encodedOptions));
+            $publicKeyCredentialRequestOptions = unserialize(base64_decode($encodedOptions), ['allowed_classes' => [PublicKeyCredentialRequestOptions::class]]);
         } catch (\Exception) {
             Log::add('Invalid plg_system_webauthn.publicKeyCredentialRequestOptions in the session', Log::NOTICE, 'webauthn.system');