CVE-2026-114509 · GHSA-f9x3-7vq9-cph6
Laravel TokenGuard authentication bypass through non-string API credentials
- Risk score
- 72/100
- CVSS
- 9.2 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Laravel's TokenGuard authentication bypass vulnerability allows an attacker to bypass authentication and take over an account on routes protected by TokenGuard. This is due to a crafted non-string credential not being rejected by TokenGuard.
- Affected
- {'products': ['Laravel'], 'packages': [{'name': 'laravel/framework', 'vulnerable': '>= 13.0.0, < 13.29.0', 'patched': '13.29.0'}, {'name': 'laravel/framework', 'vulnerable': '< 12.68.0', 'patched': '12.68.0'}], 'versions': ['12.68.0', '13.29.0']}
- Fix
- Upgrade to version 12.68.0 or 13.29.0
- Exploitation
- No known exploitation
Story map
At a glance
laravel/framework: Amber, patch this week. Laravel's TokenGuard authentication bypass vulnerability allows an attacker to bypass authentication and take over an account on routes protected by TokenGuard. This is due to a crafted non-string credential not being rejected by TokenGuard.
The flaws
- CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials (CVSS 9.2 · EPSS 0%)
- CVE-2026-114508: Laravel relationship inclusion can trigger unauthorized data destruction (CVSS 6.5 · EPSS 0%)
The fix
Upgrade laravel/framework: 12.68.0 · 13.29.0 · 13.27.0 or later on your release line
Who is exposed: {'products': ['Laravel'], 'packages': [{'name': 'laravel/framework', 'vulnerable': '>= 13.0.0, < 13.29.0', 'patched': '13.29.0'}, {'name': 'laravel/framework', 'vulnerable': '< 12.68.0', 'patched': '12.68.0'}], 'versions': ['12.68.0', '13.29.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Authentication bypass (CWE-287). 239 other warnings in 30 days
Why it is Amber
- CVSS 9.2 critical
- Remotely exploitable without logging in
- On your watchlist: Composer
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| laravel/framework | composer | >= 13.0.0, < 13.29.0 | 13.29.0 |
| laravel/framework | composer | < 12.68.0 | 12.68.0 |
References
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.29.0
- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://github.com/advisories/GHSA-f9x3-7vq9-cph6
- https://nvd.nist.gov/vuln/detail/CVE-2026-114509
- https://github.com/advisories/GHSA-f9x3-7vq9-cph6
Original description
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Last activity 23 Oct 2026. Patch Forecast updates every hour.