Laravel TokenGuard authentication bypass through non-string API credentials (CVE-2026-114509)

Laravel's built-in TokenGuard, when configured as a standard token-based API guard, can be bypassed to log in as an arbitrary existing user without their API token. On some database configurations (MySQL/MariaDB), a crafted non-string credential is mishandled during the lookup so the query matches an unintended user instead of failing. An unauthenticated attacker can take over accounts on any route protected by that guard. Upgrade laravel/framework to 12.68.0 or 13.29.0. GitHub rates it critical (CVSS 4.0 score 9.2).

Why this severity: CVSS 4.0 9.2 per GitHub; only apps using the built-in token API guard on MySQL/MariaDB-style configurations

Started

Oct 23, 2026

CVE

CVE-2026-114509

• PHP
• #Laravel
• Auth bypass
• #Mysql
• #Mariadb