CVE-2026-114509 PUBLISHED

Laravel TokenGuard authentication bypass through non-string API credentials

Assigner: GitHub_M
Reserved: 21.10.2026 Published: 21.10.2026 Updated: 21.10.2026

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	laravel
Product	framework
Versions	Version < 12.68.0 is affected Version >= 13.0.0, < 13.29.0 is affected

References

Problem Types

CWE-287: Improper Authentication CWE
CWE-1287: Improper Validation of Specified Type of Input CWE