Laravel Framework: Authentication bypass in TokenGuard via non-string tokens

Summary

The TokenGuard API authentication guard in the Laravel framework accepts crafted non-string credentials without rejecting them. On affected MySQL or MariaDB configurations, the user lookup can match an unintended existing user. An unauthenticated remote attacker can thereby bypass authentication and take over accounts on routes protected by TokenGuard. Only applications using the token guard are affected; Sanctum and Passport are not covered by this advisory.

Affected

• laravel/framework below 12.68.0
• laravel/framework 13.0.0 up to below 13.29.0
• Laravel 11 and older: unclear, the vendor advisory names no fix for 11.x; 11.x receives no security fixes and must be upgraded

Fixed in

• laravel/framework 12.68.0
• laravel/framework 13.29.0

Workaround

• No official workaround exists; upgrading is the fix.
• An unofficial, unverified request-level check has been described publicly; if used, remove it after upgrading.

Exploitation

• Not listed in CISA KEV as of 24 Oct 2026; no confirmed attacks reported.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• A public proof of concept is reported to exist; it has not been verified by us.
• EPSS score at the 33rd percentile.

Our recommendation

• Priority: critical, patch now.
• Find all Laravel installations, including transitive dependencies, via composer.lock and composer audit.
• Upgrade to 12.68.0, 13.29.0 or later; replace 11.x or older installations.
• Check whether the token guard is used with MySQL or MariaDB and review logs since 19 Oct 2026 for token parameters that are not plain strings, such as arrays or JSON objects; treat hits as possible compromise.
• If the upgrade is delayed, restrict the affected APIs to trusted networks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (7 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  hakaioffsec/CVE-2026-114509-PoC · tajulasri/-CVE-2026-114509-POC · dimasma0305/CVE-2026-114509 · ArioVeisa/cve-2026-114509-laravel-tokenguard · Nxploited/CVE-2026-114509

Research sources

• GitHub Security Advisory GHSA-f9x3-7vq9-cph6 github.com
• Fix commit 8dbb08b github.com
• Fix commit 9b21ce0 github.com
• Laravel release v12.68.0 github.com
• Laravel release v13.29.0 github.com
• GitHub Advisory Database GHSA-f9x3-7vq9-cph6 github.com
• Brandefense CVE-2026-114509 brandefense.io
• GitLab Advisory CVE-2026-114509 advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:06.