Laravel TokenGuard Authentication Bypass (CVE-2026-114509)

Laravel's built-in TokenGuard reads an API token from a request and looks up the user who owns it. The advisory says that, when an app uses the standard token-based API guard, an attacker can send a crafted value that is not a string. That lets the attacker authenticate as another existing user without knowing that user's token. It describes the result as authentication bypass and account takeover on any route the guard protects. The attacker needs no login. It is a form of account takeover.

What the Guard Did Wrong

The commit that fixes it shows the gap. Before the fix, the guard's user() method only tested that the token was not empty. An array with one item passes that test. The fix adds a check that the token is a string, and the same change makes validate() reject any credential that is not a string. The advisory says that under certain MySQL and MariaDB configurations the database lookup then matches an unintended user record. It does not name the configurations or publish the exploit detail.

In ATT&CK terms the closest entry is Valid Accounts (T1078), which MITRE describes as abusing the credentials of existing accounts. This flaw reaches a similar result without the credential, so treat the label as approximate.

What Our Checks Showed

GitHub: three public repositories about the flaw turned up in our search on 24 October. The first was created on 20 October 2026, about 12 hours after the advisory. Its README says it holds a lab with a vulnerable and a patched app plus a script. We read them and did not run or link them.

X: our search returned 28 unique public posts from 19 to 23 October. Hakai Security, a security company, posted on 20 October that its team published a working proof of concept and exploit. Italy's national CSIRT said on 22 October that a proof of concept is available, and the national cybersecurity agency ACN published the matching alert.

Our Laravel TokenGuard news post walks through the request path, the two-line fix and the checks.

The advisory lists laravel/framework versions below 12.68.0 and below 13.29.0. The CVE record lists below 12.68.0, and 13.0.0 up to below 13.29.0. The fixed versions are 12.68.0 and 13.29.0. The flaw applies only when the app uses the standard token-based API guard, which is a guard in config/auth.php whose driver is token.

• Apps with a token guard on auth: routes and users in MySQL or MariaDB. The advisory limits the flaw to certain configurations of these two databases.
• Older apps. In the laravel/laravel skeleton, tag v8.5.0 defined an api guard with driver token. From tag v8.6.0 on, the skeleton lists only the web session guard.

Not Described by the Advisory

The advisory does not mention Sanctum or Passport. Laravel's documentation says Sanctum uses a sanctum guard and Passport uses a guard with the driver passport.

Older Laravel Lines

Laravel's support policy page says security fixes for Laravel 11 ended on 12 March 2026 and for Laravel 10 on 4 February 2025. Laravel 12 gets them until 24 February 2027 and Laravel 13 until 17 March 2028. The advisory names no fixed 10.x or 11.x release. A tag v11.56.1, dated 25 August 2026, carries the new check.

The Sibling Advisory

GHSA-5wcm-3v2w-8362 (CVE-2026-114508), "Unauthorized Data Destruction", was published 11 seconds later and is rated medium. It lists 12.68.0 as fixed on the 12.x line and 13.27.0 on 13.x.