TokenGuard Vulnerability in Laravel Web Application Framework
CVE-2026-114509

9.2CRITICAL

Key Information:

Vendor

Laravel

Status
Framework
Vendor
CVE Published:
21 October 2026

Badges

📈 Score: 455👾 Exploit Exists🟡 Public PoC

What is CVE-2026-114509?

CVE-2026-114509 is a vulnerability affecting the Laravel web application framework, a popular tool for developers to create web applications swiftly and securely. The specific issue lies with the TokenGuard component, which is utilized for token-based API authentication. Prior to the releases of versions 12.68.0 and 13.29.0, TokenGuard was susceptible to a flaw wherein a crafted non-string credential could be incorrectly accepted. This misconfiguration allows an attacker to bypass standard authentication processes, potentially giving them access to user accounts without proper credentials on routes secured by the TokenGuard. This vulnerability poses a significant threat to organizations leveraging the Laravel framework for web applications, as it can lead to unauthorized access and account takeovers, thereby jeopardizing sensitive user data and the integrity of application functionality.

Potential impact of CVE-2026-114509

  1. Account Takeover: The vulnerability allows attackers to impersonate legitimate users by bypassing authentication. This can result in unauthorized access to personal data, modifying user settings, and conducting actions on behalf of the user.

  2. Data Breaches: Exploiting this vulnerability could enable attackers to gain access to confidential information stored within a web application, leading to potential data leaks and breaches which could harm both the organization and its users.

  3. Reputation Damage: The compromise of user accounts and potential data breaches can significantly damage an organization’s reputation. Trust is vital in digital services, and incidents stemming from this vulnerability could lead to loss of customer confidence and a decline in user engagement.

Affected Version(s)

framework < 12.68.0 < 12.68.0

framework >= 13.0.0, < 13.29.0 < 13.0.0, 13.29.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

project2026_20261030_tokengate
Created by Nguemoue

-CVE-2026-114509-POC
Created by tajulasri

cve-2026-114509-laravel-tokenguard
Created by ArioVeisa

References

https://github.com/laravel/framework/security/advisories/...
x_refsource_CONFIRM
https://github.com/laravel/framework/commit/8dbb08bccac1b...
x_refsource_MISC
https://github.com/laravel/framework/commit/9b21ce0a9bb2b...
x_refsource_MISC

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.