CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials

Q: Which deployments are exposed to this bypass?

Deployments using Laravel TokenGuard as a standard token-based API guard on affected MySQL or MariaDB configurations are exposed. Routes protected by that guard may be affected.

Q: Does an attacker need valid API credentials or an existing account?

No. An unauthenticated attacker can submit a crafted non-string credential that causes the authentication lookup to match an unintended existing user.

Q: What is the impact if exploitation succeeds?

The attacker can bypass TokenGuard authentication and take over the account of the user unintentionally matched by the lookup.

Q: Which versions contain the fix?

The issue is fixed in Laravel versions 12.68.0 and 13.29.0. Versions before those releases are affected as described.

Published Oct 21, 2026

Updated

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Affected Software

1 affected component

Laravel Laravel<12.68.0, <13.29.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Laravel 12 to a version that resolves this vulnerability.
Fixed in 12.68.0
Upgrade
Upgrade Laravel 13 to a version that resolves this vulnerability.
Fixed in 13.29.0

Event History

Oct 21, 2026

CVE Published

via MITRE·09:49 PM

Data Sourced

via MITRE·09:49 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this bypass?

Deployments using Laravel TokenGuard as a standard token-based API guard on affected MySQL or MariaDB configurations are exposed. Routes protected by that guard may be affected.

Does an attacker need valid API credentials or an existing account?

No. An unauthenticated attacker can submit a crafted non-string credential that causes the authentication lookup to match an unintended existing user.

What is the impact if exploitation succeeds?

The attacker can bypass TokenGuard authentication and take over the account of the user unintentionally matched by the lookup.

Which versions contain the fix?

The issue is fixed in Laravel versions 12.68.0 and 13.29.0. Versions before those releases are affected as described.

CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this bypass?

Does an attacker need valid API credentials or an existing account?

What is the impact if exploitation succeeds?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this bypass?

Does an attacker need valid API credentials or an existing account?

What is the impact if exploitation succeeds?

Which versions contain the fix?