CVE-2026-114509Critical· 9.2▾ AbyssalPoC availableLaravel TokenGuard authentication bypass through non-string API credentials
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
6 GitHub repos
Disclosed via GHSA
0.4%
0.4% → 0.7%
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.
An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.
laravel/framework >= 13.0.0, < 13.29.0laravel/framework < 12.68.0Upgrade to a patched release:
laravel/framework 13.29.0laravel/framework 12.68.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114508Medium· 6.5Laravel relationship inclusion can trigger unauthorized data destruction
GHSA-5vg9-5847-vvmqHigh· 8.9Laravel Framework: CRLF injection in default email rule
GHSA-crmm-hgp2-wgrpMedium· 4.2Laravel Framework: Temporary Signed URL Path Confusion
CVE-2026-102279Low· 3.1Laravel is a web application framework
CVE-2026-48019High· 8.9Laravel is a web application framework
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1