Critical severity · published Oct 21, 2026
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
New
9.2
CVSS
0.7%
EPSS
No
On KEV
Description
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
framework · laravel
< 12.68.0; >= 13.0.0, < 13.29.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114509
github.com
https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
github.com
https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
github.com
https://github.com/laravel/framework/releases/tag/v12.68.0
github.com
https://github.com/laravel/framework/releases/tag/v13.29.0
github.com
https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
More from framework
9.8
CVE-2025-27515
Laravel is a web application framework
9.8
CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for…
8.9
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
8.8
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17
8.8
CVE-2018-6330
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters