PKSA-b41t-wbzk-9q51: Laravel TokenGuard authentication bypass through non-string API credentials
Published Oct 23, 2026
·Updated
Laravel TokenGuard authentication bypass through non-string API credentials
Affected Software
2 affected componentsFixes available
composer/laravel/framework<12.68.0
12.68.0
composer/laravel/framework>=13.0.0, <13.29.0
13.29.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/laravel/frameworkto a version that resolves this vulnerability.Fixed in 12.68.0 - Upgrade
Upgrade
composer/laravel/frameworkto a version that resolves this vulnerability.Fixed in 13.29.0
Event History
Oct 23, 2026
Advisory Published
via Packagist·09:50 PM
Data Sourced
via Packagist·09:50 PM
DescriptionSeverityAffected Software