Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)
Severity: critical · Patch status: patched · Since 2026-10-19 · CVE-2026-114509
A critical authentication bypass (CVE-2026-114509, CVSS 9.2) was disclosed in Laravel's built-in TokenGuard. When a standard token-based API guard is configured, an unauthenticated attacker can submit a specially crafted non-string credential value that is mishandled during the authentication lookup; under certain MySQL/MariaDB database configurations the query matches an unintended user record, letting the attacker authenticate as an arbitrary existing user without knowing their API token. Any route protected by the affected guard is exposed to account takeover. Fixes were released in laravel/framework 12.68.0 and 13.29.0 on 2026-10-19/23; no in-the-wild exploitation is known.
What to do
- Upgrade laravel/framework to 12.68.0 (Laravel 12) or 13.29.0 (Laravel 13) immediately
- Audit applications for use of token-based API guards and treat those routes as exposed until patched
- Review auth logs for anomalous API token authentication or unexpected user sessions
- If immediate upgrade is not possible, add middleware or validation rejecting non-string API token credentials
- Verify database configuration (MySQL/MariaDB collation/type coercion behaviour) and consider hardening token column comparisons
Fixed versions
- laravel/framework 13.29.0
- laravel/framework 12.68.0
Sources
All live incidents on Threat Watch
