PT-2026-120839 · Laravel · Laravel
CVE-2026-114509
·
Published
2026-10-21
·
Updated
2026-10-22
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Laravel versions prior to 12.68.0
Laravel versions prior to 13.29.0
Description
TokenGuard, when configured as a standard token-based API guard, fails to reject crafted non-string credentials. In specific MySQL or MariaDB configurations, the authentication lookup may match an unintended existing user. This allows an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard.
Recommendations
Update Laravel to version 12.68.0 or later.
Update Laravel to version 13.29.0 or later.
Inspect
config/auth.php for guards using the driver => token configuration and restrict access to the affected API routes until the update is applied.Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Laravel