GHSA-f9x3-7vq9-cph6 CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

Critical Packagist

Severity: 0.0 / 10; Critical · CVSS 4.0
Exploit chance (EPSS): 0.78%; Chance of exploitation in the next 30 days. Higher than 55.86% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1287 Improper Validation of Specified Type of Input; CWE-287 Improper Authentication
Fix: 13.29.0; Upgrade laravel/framework to this version or later

Description

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.

Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

Impact

An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.

Affected versions

Packagist

Package	Vulnerable	Fixed in
laravel/framework	`>= 13.0.0, < 13.29.0`	`13.29.0`
laravel/framework	`< 12.68.0`	`12.68.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

laravel/framework Packagist → `13.29.0`

composer

composer require laravel/framework:^13.29.0

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-1287: Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

How to prevent it

Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it

Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-114509

Packages

github.com/laravel/framework

Timeline

Oct 21, 2026 Published
Oct 28, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
CVE-2018-15133 Laravel Framework RCE Vulnerability	High Known exploited	Also affects laravel/framework
GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction	Medium	Also affects laravel/framework
GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information	Low	Also affects laravel/framework
GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion	Medium	Also affects laravel/framework
GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule	High	Also affects laravel/framework
GHSA-83wp-f5c3-hqqr Laravel framework susceptible to reflected cross-site scripting	Medium	Also affects laravel/framework
GHSA-546h-56qp-8jmw Laravel framework susceptible to reflected cross-site scripting	Medium	Also affects laravel/framework
GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass	Critical	Also affects laravel/framework

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor