                unset($k, $v);
            }
        }

        return self::$user;
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.