Vulnerability details
CVE-2026-114509
laravel framework
Laravel TokenGuard authentication bypass through non-string API credentials
CVSS 4.0
9.2Critical
Official description
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.2Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| laravel | framework | < 12.68.0 | CVEProject cvelistV5 (CNA) |
| laravel | framework | >= 13.0.0, < 13.29.0 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6 x_refsource_CONFIRM
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5 x_refsource_MISC
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c x_refsource_MISC
- https://github.com/laravel/framework/releases/tag/v12.68.0 x_refsource_MISC
- https://github.com/laravel/framework/releases/tag/v13.29.0 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-22
- Last updated
- 2026-10-28
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 34 · Low
Exploit prediction (EPSS)
1.84%
Probability of exploitation in 30 days
79%
Percentile (among all CVEs)
- 2026-11-051.84%
- 2026-11-030.77%
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-287Improper Authentication
- CWE-1287Improper Validation of Specified Type of Input