CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
CRITICAL 9.2EPSS 0.8%
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
- Affected
- laravel · framework
- CVSS v4.0 GITHUB
- 9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v4.0 GitHub
- 9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EPSS
- 0.78% chance of exploitation in the next 30 days, 56th percentile
- Published
- 2026-10-21
- Updated
- 2026-10-28
Proof-of-concept exploits (6)
- hakaioffsec/CVE-2026-114509-PoCRepo stars 12★ · pushed 2026-10-23 · find archive
- tajulasri/-CVE-2026-114509-POCRepo stars 1★ · pushed 2026-10-22 · snapshot
- ArioVeisa/cve-2026-114509-laravel-tokenguardRepo stars 0★ · pushed 2026-10-24 · snapshot
- dimasma0305/CVE-2026-114509Repo stars 0★ · pushed 2026-10-27 · snapshot
- Nxploited/CVE-2026-114509Repo stars 0★ · pushed 2026-10-27 · snapshot
1 file
- piecar21/CVE-2026-114509Repo metadata unavailable ·
CVE references
- advisories/GHSA-f9x3-7vq9-cph6ADVISORY
- laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5REFERENCE
- laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31cREFERENCE
- laravel/framework/releases/tag/v12.68.0REFERENCE
- laravel/framework/releases/tag/v13.29.0REFERENCE
- laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6REFERENCE