CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials
Laravel’s built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.
References
- github.com/advisories/GHSA-f9x3-7vq9-cph6
- github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- github.com/laravel/framework/releases/tag/v12.68.0
- github.com/laravel/framework/releases/tag/v13.29.0
- github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- nvd.nist.gov/vuln/detail/CVE-2026-114509
Code Behaviors & Features
Detect and mitigate CVE-2026-114509 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →