TokenGuard Vulnerability in Laravel Web Application Framework
CVE-2026-114509

9.2CRITICAL

Key Information:

Vendor

Laravel

Status
Framework
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114509?

The Laravel web application framework has a vulnerability in the TokenGuard, specifically when configured as a standard token-based API guard. Prior to versions 12.68.0 and 13.29.0, this flaw allows an attacker to bypass authentication by submitting a crafted non-string credential. Under certain MySQL or MariaDB configurations, this can lead to an unintended match with an existing user account, enabling unauthorized access to routes secured by the TokenGuard. To mitigate this risk, it is essential for users to upgrade to the fixed versions 12.68.0 or 13.29.0.

Affected Version(s)

framework < 12.68.0 < 12.68.0

framework >= 13.0.0, < 13.29.0 < 13.0.0, 13.29.0

References

https://github.com/laravel/framework/security/advisories/...
x_refsource_CONFIRM
https://github.com/laravel/framework/commit/8dbb08bccac1b...
x_refsource_MISC
https://github.com/laravel/framework/commit/9b21ce0a9bb2b...
x_refsource_MISC

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.