CVE-2026-114509
published 2026-10-21CVE-2026-114509: Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted…
PriorityP192critical9.2CVSS 4.0
AVNACLATPPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
0.70%
52.8th percentile
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| laravel | framework | < 12.68.0 | 12.68.0 |
| laravel | framework | — | — |
| laravel | framework | >= 0 < 12.68.0 | 12.68.0 |
| laravel | framework | >= 13.0.0 < 13.29.0 | 13.29.0 |
CVSS provenance
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.2CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Laravel TokenGuard authentication bypass through non-string API credentials
ghsa·2026-10-23
CVE-2026-114509 [CRITICAL] CWE-1287 Laravel TokenGuard authentication bypass through non-string API credentials
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.
### Impact
An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.
VulDB
Laravel up to 12.67.x/13.28.x TokenGuard improper authentication
vuldb·2026-10-22·CVSS 9.2
CVE-2026-114509 [CRITICAL] Laravel up to 12.67.x/13.28.x TokenGuard improper authentication
A vulnerability, which was classified as critical, has been found in Laravel up to 12.67.x/13.28.x. The affected element is the function TokenGuard. Performing a manipulation results in improper authentication.
This vulnerability was named CVE-2026-114509. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
VulnCheck
Laravel Laravel Framework Improper Authentication
vulncheck·2026·CVSS 9.2
CVE-2026-114509 [CRITICAL] Laravel Laravel Framework Improper Authentication
Laravel Laravel Framework Improper Authentication
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Affected: Laravel Laravel Framework
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previdian.com/CVE-2026-114509
Exploit PoC: https://vuln
No detection rules found.
No public exploits indexed.
https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31chttps://github.com/laravel/framework/releases/tag/v12.68.0https://github.com/laravel/framework/releases/tag/v13.29.0https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
2026-10-21
Published
Exploited in the wild