CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

En bref

Sévérité: CRITICAL 9.2
EPSS: EPSS 0.70 % · centile 53 (2026-10-27)
État: PUBLISHED
Publiée: 2026-10-21
Mise à jour: 2026-10-21
Attribuée par: GitHub_M
Statut NVD: Awaiting Analysis

Description

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)

Faiblesses (CWE)

Avis

GHSA-f9x3-7vq9-cph6 — Laravel TokenGuard authentication bypass through non-string API credentials

Références européennes

ENISA EUVD · EUVD-2026-107583
GCVE · GCVE-0-2026-114509

Produits affectés

Produit	Versions
laravel · framework	affected < 12.68.0 ; affected >= 13.0.0, < 13.29.0

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD