Mysql
Security incidents tagged Mysql. Newest first.
1 Mysql incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 0 days
- Patched
Laravel TokenGuard authentication bypass through non-string API credentials (CVE-2026-114509)
Laravel's built-in TokenGuard, when configured as a standard token-based API guard, can be bypassed to log in as an arbitrary existing user without their API token. On some database configurations (MySQL/MariaDB), a crafted non-string credential is mishandled during the lookup so the query matches an unintended user instead of failing. An unauthenticated attacker can take over accounts on any route protected by that guard. Upgrade laravel/framework to 12.68.0 or 13.29.0. GitHub rates it critical (CVSS 4.0 score 9.2).
Laravel framework (laravel/framework) TokenGuardSince Oct 23, 2026
