{"id":"CVE-2026-114509","aliases":["GHSA-f9x3-7vq9-cph6"],"url":"https://o3.security/vulnerability/CVE-2026-114509","summary":"Laravel TokenGuard authentication bypass through non-string API credentials","details":"Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.\n\n### Impact\nAn unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.","published":"2026-10-21T21:49:29.486Z","modified":"2026-10-24T02:48:56.180307113Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"laravel/framework","fixedVersion":"13.29.0"},{"ecosystem":"Packagist","name":"laravel/framework","fixedVersion":"12.68.0"}],"fix":{"url":"https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5","label":"laravel/framework@8dbb08b"},"references":[{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v12.68.0"},{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v13.29.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114509.json"},{"type":"ADVISORY","url":"https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114509"},{"type":"FIX","url":"https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5"},{"type":"FIX","url":"https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c"},{"type":"PACKAGE","url":"https://github.com/laravel/framework"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:48:56.180307113Z"}}