https://pwn.watch/i/laravel-tokenguard-auth-bypass-cve-2026-114509 Laravel's built-in TokenGuard, when configured as a standard token-based API guard, can be bypassed to log in as an arbitrary existing user without their API token. On some database configurations (MySQL/MariaDB), a crafted non-string credential is mishandled during the lookup so the query matches an unintended user instead of failing. An unauthenticated attacker can take over accounts on any route protected by that guard. Upgrade laravel/framework to 12.68.0 or 13.29.0. GitHub rates it critical (CVSS 4.0 score 9.2). en Fri, 23 Oct 2026 00:00:00 GMT https://pwn.watch/i/laravel-tokenguard-auth-bypass-cve-2026-114509 https://pwn.watch/i/laravel-tokenguard-auth-bypass-cve-2026-114509#2026-10-23-e24c6604 Fri, 23 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6">Source</a></p>