CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

At a glance

Severity: CRITICAL 9.2
EPSS: EPSS 0.70 % · percentile 53 (2026-10-27)
State: PUBLISHED
Published: 2026-10-21
Updated: 2026-10-21
Assigner: GitHub_M
NVD status: Awaiting Analysis

Description

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)

Weaknesses (CWE)

Advisories

GHSA-f9x3-7vq9-cph6 — Laravel TokenGuard authentication bypass through non-string API credentials

European references

ENISA EUVD · EUVD-2026-107583
GCVE · GCVE-0-2026-114509

Affected products

Product	Versions
laravel · framework	affected < 12.68.0 ; affected >= 13.0.0, < 13.29.0

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD