---
id: "CVE-2026-114509"
kind: "vulnerability"
aliases: ["CVE-2026-114509", "GHSA-f9x3-7vq9-cph6"]
title: "Laravel TokenGuard authentication bypass through non-string API credentials"
severity: "critical"
cvss: 9.2
epss: 0.00403
exploited: false
status: "open"
category: "package"
products: [{"name": "laravel/framework", "fixed": ["13.29.0"], "affected": ">= 13.0.0, < 13.29.0", "ecosystem": "composer"}, {"name": "laravel/framework", "fixed": ["12.68.0"], "affected": "< 12.68.0", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "cwe-287", "poc-public", "cwe-1287", "laravel", "php", "package", "api-auth"]
not_affected_if: ["already-patched", "no-token-guard", "postgres-or-sqlite"]
published_at: "2026-10-21T22:16:49+00:00"
first_seen_at: "2026-10-23T21:51:54+00:00"
updated_at: "2026-10-24T19:23:49+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-f9x3-7vq9-cph6", "first_seen_at": "2026-10-23T21:51:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114509", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "github-poc", "url": "https://github.com/dimasma0305/CVE-2026-114509", "first_seen_at": "2026-10-24T01:30:40+00:00"}, {"source": "github-poc", "url": "https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard", "first_seen_at": "2026-10-24T10:50:41+00:00"}, {"source": "github-poc", "url": "https://github.com/emirwtz/CVE-2026-114509", "first_seen_at": "2026-10-24T19:23:49+00:00"}]
---

# Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard can be tricked into authenticating as an existing user when an attacker sends a crafted non-string API token value. On MySQL or MariaDB the authentication query matches an unintended user record, so an attacker gets that user's account without their token.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:laravel/framework affected >= 13.0.0, < 13.29.0 fixed 13.29.0
- composer:laravel/framework affected < 12.68.0 fixed 12.68.0

## How to check

Run: composer show laravel/framework | grep versions
Check config/auth.php for guards with 'driver' => 'token'
Confirm the database driver is MySQL or MariaDB

## Fix

Upgrade laravel/framework to 13.29.0 or later on the 13.x line, or 12.68.0 or later on the 12.x line.
If you cannot upgrade now, unknown for an interim workaround.

## Timeline

- 2026-10-23T21:51:54+00:00 ghsa https://github.com/advisories/GHSA-f9x3-7vq9-cph6
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114509
- 2026-10-24T01:30:40+00:00 github-poc https://github.com/dimasma0305/CVE-2026-114509
- 2026-10-24T10:50:41+00:00 github-poc https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard
- 2026-10-24T19:23:49+00:00 github-poc https://github.com/emirwtz/CVE-2026-114509

## Documents

- [poc] dimasma0305/CVE-2026-114509 https://github.com/dimasma0305/CVE-2026-114509
- [poc] ArioVeisa/cve-2026-114509-laravel-tokenguard https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard
- [poc] emirwtz/CVE-2026-114509 https://github.com/emirwtz/CVE-2026-114509

## From the sources

Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. 

**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

### Impact
An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_