Laravel framework CVE-2026-114509 (CVSS 4.0 9.2, Critical): on MySQL/MariaDB an unauthenticated attacker can bypass the built-in token-based API guard (TokenGuard) and authenticate as any existing user; fixed in laravel/framework 13.29.0 and 12.68.0

Laravel published advisory GHSA-f9x3-7vq9-cph6 (CVE-2026-114509) for laravel/framework on 19 October 2026. Laravel says its built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token: under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, so the query matches an unintended user record instead of failing. Laravel says an unauthenticated attacker may authenticate as another user, leading to authentication bypass and account takeover on any route protected by the affected guard. The advisory rates it Critical, CVSS 4.0 9.2, lists affected versions as below 13.29.0 and below 12.68.0, patched in 13.29.0 and 12.68.0, and credits KIKOmanasijev as reporter. The Hacker News reported the fix on 22 October. No exploitation has been reported. Source: Laravel GitHub security advisory GHSA-f9x3-7vq9-cph6 (19 Oct 2026).

Product

Laravel framework (laravel/framework, Composer) — TokenGuard token-based API guard with MySQL/MariaDB

Versions

Affected: below 13.29.0 and below 12.68.0; patched: 13.29.0 and 12.68.0 (Laravel advisory, as of 23 Oct 2026)

CVSS

9.2 (CVSS 4.0, Laravel)

Exploited in Australia?

unknown

Patch to

Run composer update laravel/framework to 13.29.0 or later on the 13.x line, or 12.68.0 or later on 12.x, and redeploy. Check whether any app uses the token-based API guard on MySQL or MariaDB; after patching, review logs on guard-protected API routes for requests that authenticated as unexpected users, and rotate API tokens if anything looks wrong.

Primary: Laravel — GHSA-f9x3-7vq9-cph6: Token-based API guard Auth Bypass (19 Oct 2026) · Vendor: laravel/framework security advisory · CVE: CVE-2026-114509 · The Hacker News — report including the Laravel TokenGuard fix (22 Oct 2026)

vulnerabilities identity