{"id":"CVE-2026-114509","kind":"vulnerability","aliases":["CVE-2026-114509","GHSA-f9x3-7vq9-cph6"],"related":[],"title":"Laravel TokenGuard authentication bypass through non-string API credentials","description":"Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.\n\n### Impact\nAn unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.","summary":"Laravel's built-in TokenGuard can be tricked into authenticating as an existing user when an attacker sends a crafted non-string API token value. On MySQL or MariaDB the authentication query matches an unintended user record, so an attacker gets that user's account without their token.","severity":"critical","cvss":9.2,"epss":0.00403,"exploited":false,"exploited_at":null,"products":[{"name":"laravel/framework","fixed":["13.29.0"],"affected":">= 13.0.0, < 13.29.0","ecosystem":"composer"},{"name":"laravel/framework","fixed":["12.68.0"],"affected":"< 12.68.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","cwe-287","poc-public","cwe-1287","laravel","php","package","api-auth"],"not_affected_if":["already-patched","no-token-guard","postgres-or-sqlite"],"how_to_check":"Run: composer show laravel/framework | grep versions\nCheck config/auth.php for guards with 'driver' => 'token'\nConfirm the database driver is MySQL or MariaDB","fix":"Upgrade laravel/framework to 13.29.0 or later on the 13.x line, or 12.68.0 or later on the 12.x line.\nIf you cannot upgrade now, unknown for an interim workaround.","status":"open","published_at":"2026-10-21T22:16:49+00:00","first_seen_at":"2026-10-23T21:51:54+00:00","triaged_at":"2026-10-23T21:52:58+00:00","updated_at":"2026-10-24T19:23:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:52:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade laravel/framework to 13.29.0 or later on the 13.x line, or 12.68.0 or later on the 12.x line.\nIf you cannot upgrade now, unknown for an interim workaround.","reach":"internet","impact":"high","summary":"Laravel's built-in TokenGuard can be tricked into authenticating as an existing user when an attacker sends a crafted non-string API token value. On MySQL or MariaDB the authentication query matches an unintended user record, so an attacker gets that user's account without their token.","category":"package","who_cares":["laravel","php","composer","api-auth"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker logs in as any existing user on protected API routes.","analyst_note":"Sources do not say whether a non-upgrade workaround exists or exactly which non-string input types trigger it; check the GHSA-f9x3-7vq9-cph6 advisory page for details.","how_to_check":"Run: composer show laravel/framework | grep versions\nCheck config/auth.php for guards with 'driver' => 'token'\nConfirm the database driver is MySQL or MariaDB","needs_analyst":true,"not_affected_if":["no-token-guard","postgres-or-sqlite","already-patched"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000536,"input_tokens":2983,"output_tokens":476,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114509':13A,21A '-1287':31B '-2026':12A,20A '-287':26B '7vq9':17A 'account':84B,182C 'affect':190C 'anoth':168C 'api':9A,36B,62B,102C,119C,175C 'api-auth':35B 'arbitrari':111C 'attack':55B,79B,127C,164C 'auth':37B 'authent':3A,48B,70B,108C,143C,158C,166C,179C 'base':101C 'built':41B,91C 'built-in':40B,90C 'bypass':4A,106C,180C 'caus':145C 'certain':122C 'compos':24B 'configur':95C,124C 'cph6':18A 'craft':58B,132C 'credenti':10A,136C 'cve':11A,19A 'cwe':25B,30B 'databas':123C 'exist':51B,112C 'expect':160C 'f9x3':16A 'fail':157C 'get':80B 'ghsa':15A 'ghsa-f9x3-7vq9-cph6':14A 'guard':103C,191C 'impact':161C 'knowledg':115C 'laravel':1A,32B,38B,88C 'laravel/framework':22A,23A 'lead':177C 'lookup':144C 'mariadb':68B 'match':72B,150C 'may':104C,165C 'mishandl':140C 'mysql':66B 'mysql/mariadb':125C 'non':7A,60B,134C 'non-str':6A,59B,133C 'packag':34B 'php':33B 'poc':28B 'poc-publ':27B 'possess':171C 'protect':187C 'public':29B 'queri':71B,148C 'rather':155C 'record':76B,154C 'rout':186C 'send':56B 'special':131C 'standard':98C 'string':8A,61B,135C 'submit':129C 'takeov':183C 'token':63B,87B,100C,120C,176C 'token-bas':99C 'tokenguard':2A,43B,93C 'trick':46B 'unauthent':163C 'under':147C 'unintend':74B,152C 'user':52B,75B,82B,113C,153C,169C,173C 'valid':118C 'valu':64B,137C 'without':85B,114C,170C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":3,"sources":[{"source":"ghsa","external_id":"GHSA-f9x3-7vq9-cph6","url":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","severity":"critical","published_at":"2026-10-23T21:50:27+00:00","modified_at":"2026-10-23T21:50:28+00:00","first_seen_at":"2026-10-23T21:51:54+00:00","fetched_at":"2026-10-23T21:51:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114509","severity":null,"published_at":"2026-10-21T22:16:49+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"github-poc","external_id":"dimasma0305/CVE-2026-114509","url":"https://github.com/dimasma0305/CVE-2026-114509","severity":null,"published_at":"2026-10-24T01:12:34+00:00","modified_at":null,"first_seen_at":"2026-10-24T01:30:40+00:00","fetched_at":"2026-10-24T01:30:40+00:00","note":null},{"source":"github-poc","external_id":"ArioVeisa/cve-2026-114509-laravel-tokenguard","url":"https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard","severity":null,"published_at":"2026-10-24T10:39:10+00:00","modified_at":null,"first_seen_at":"2026-10-24T10:50:41+00:00","fetched_at":"2026-10-24T10:50:41+00:00","note":null},{"source":"github-poc","external_id":"emirwtz/CVE-2026-114509","url":"https://github.com/emirwtz/CVE-2026-114509","severity":null,"published_at":"2026-10-24T19:13:31+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:23:49+00:00","fetched_at":"2026-10-24T19:23:49+00:00","note":null}],"documents":[{"id":2662,"url":"https://github.com/dimasma0305/CVE-2026-114509","title":"dimasma0305/CVE-2026-114509","kind":"poc","source":"github","text":"Reproducible local Laravel lab and self-checking PoC for CVE-2026-114509\n\nstars 0","published_at":"2026-10-24T01:12:34+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2733,"url":"https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard","title":"ArioVeisa/cve-2026-114509-laravel-tokenguard","kind":"poc","source":"github","text":"CVE-2026-114509 — Laravel TokenGuard authentication bypass (CVSS 9.2): PoC, root-cause analysis, Docker lab, and reproduction guide\n\nstars 0","published_at":"2026-10-24T10:39:10+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2937,"url":"https://github.com/emirwtz/CVE-2026-114509","title":"emirwtz/CVE-2026-114509","kind":"poc","source":"github","text":"Python detector for Laravel TokenGuard CVE-2026-114509 with local dependency analysis, remote authentication checks, and JSON reporting.\n\nstars 1","published_at":"2026-10-24T19:13:31+00:00","relation":"poc","confidence":null,"note":"1 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}