{"id":"CVE-2026-114509","aliases":["GHSA-f9x3-7vq9-cph6"],"title":"Laravel TokenGuard authentication bypass through non-string API credentials","summary":"Laravel TokenGuard authentication bypass through non-string API credentials","severity":"critical","cvss":9.2,"cwe":["CWE-287","CWE-1287"],"vendor":"laravel","product":"laravel/framework","ecosystem":"composer","affected":["laravel/framework >= 13.0.0, < 13.29.0","laravel/framework < 12.68.0"],"patched":["laravel/framework 13.29.0","laravel/framework 12.68.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:50:28Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","references":[{"url":"https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114509"},{"url":"https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5"},{"url":"https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c"},{"url":"https://github.com/laravel/framework/releases/tag/v12.68.0"},{"url":"https://github.com/laravel/framework/releases/tag/v13.29.0"},{"url":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6"}],"tags":["ghsa","composer","exploit-available","cve.org"],"epss":0.00696,"epssPercentile":0.52828,"exploits":{"github":6,"githubRepos":["https://github.com/hakaioffsec/CVE-2026-114509-PoC","https://github.com/tajulasri/-CVE-2026-114509-POC","https://github.com/emirwtz/CVE-2026-114509"],"checkedAt":"2026-10-27T16:58:45.323Z"},"exploitAvailable":true,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","ingestedAt":"2026-10-21T22:18:33.745Z","slug":"CVE-2026-114509","body":"## Overview\n\nLaravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.\n\n### Impact\nAn unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.\n\n## Affected packages\n\n- `laravel/framework >= 13.0.0, < 13.29.0`\n- `laravel/framework < 12.68.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `laravel/framework 13.29.0`\n- `laravel/framework 12.68.0`","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":50.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":227642,"id":"CVE-2026-114509","ts":1792685699465,"field":"exploit_available","old":"false","new":"true"}]}