Skip to content
THREATWIRE
CriticalPoC Available

CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard (the token driver behind auth:api) did not reject non-string credentials. On MySQL or MariaDB, an unauthenticated attacker could be logged in as an existing user without a valid API token. CVSS 4.0 9.2 (GitHub CNA). Fixed in late August 2026; advisory published 19 October 2026. Public PoC from Hakai Security. Not in CISA KEV.

By ThreatWire Desk · Published 21 Oct 2026 · Updated 25 Oct 2026

CVSS
9.2
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Class
Auth bypass
Status
PoC Available
KEV
Not in CISA KEV
0-day
No
Vendor
Laravel
Products
laravel/framework (TokenGuard, token driver)
Affected
laravel/framework before 12.68.0, and 13.x before 13.29.0, per the GitHub advisory and NVD. Hakai Security also lists 11.x before 11.56.1. Exploitable only when the app uses the built-in token guard and the users table is on MySQL or MariaDB.
Fixed
13.29.0 and 12.68.0 per the advisory (released 25 August 2026). The fix commits are dated 25 August 2026 (UTC). Git history shows the fix first shipped in 13.27.0 for 13.x. Laravel 11.56.1 carries a backport of the same fix (tag dated 25 August 2026), not listed in the advisory.
CWE
CWE-287, CWE-1287
Published
21 Oct 2026
Updated
25 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2026-114509 is an authentication bypass in Laravel's built-in TokenGuard. That is the guard behind the classic token driver, usually wired as auth:api.

The GitHub advisory GHSA-f9x3-7vq9-cph6 was published on 19 October 2026. The CVE reached NVD on 21 October 2026. The fix itself is older: Laravel shipped it on 25 August 2026, almost two months earlier.

GitHub, acting as CNA, scores it CVSS 4.0 9.2 (Critical). The full vector is in the CVSS field. NVD has not added its own score yet.

The guard only checked that the token was not empty. It did not check that it was a string. Under MySQL or MariaDB, a crafted non-string value could make the user lookup match an existing account. The result is login as that user, with no valid token.

Scope is narrow. It needs the built-in token guard and a users table on MySQL or MariaDB. The advisory names no other database. Sanctum and Passport use their own guards and are not named.

Fixed versions are 13.29.0 and 12.68.0, per the advisory. Hakai Security also lists 11.56.1 for the 11.x line.

Hakai Security (Yokai Research) published an analysis and a public PoC with a Docker lab. ThreatWire read the repository and did not execute it. No source reports exploitation in the wild. The CVE is not in CISA KEV as of 25 October 2026.

Read the full story and what to check.

Sources

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-114509