Every CVE Search/ Get API key

CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

9.2 CriticalPublic exploitFix available

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.84%Up 1.4 points since Oct 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Record
CVE-2026-114509
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-287, CWE-1287
Updated
2026-11-02
EUVDEUVD-2026-107583 9.2

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Record
EUVD-2026-107583
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-f9x3-7vq9-cph6 9.2

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.

Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

Impact

An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.

Record
GHSA-f9x3-7vq9-cph6
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-287, CWE-1287
Updated
2026-11-02
NVD 9.2

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Record
CVE-2026-114509
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-287, CWE-1287
Updated
2026-11-02
OSV 9.2

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Record
CVE-2026-114509
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1287, CWE-287
Updated
2026-11-02
OSVDEBIAN-CVE-2026-114509 9.2

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Record
DEBIAN-CVE-2026-114509
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 19 moreShow less
OSVGHSA-f9x3-7vq9-cph6 9.2

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.

Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

Impact

An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.

Record
GHSA-f9x3-7vq9-cph6
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1287, CWE-287
Updated
2026-11-02
OSVCLSA-2026-1793031697 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.28-p3+tuxcare.

Record
CLSA-2026-1793031697
Updated
2026-11-02
OSVCLSA-2026-1793092408 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p4+tuxcare.

Record
CLSA-2026-1793092408
Updated
2026-11-02
OSVCLSA-2026-1793190394 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.29-p2+tuxcare.

Record
CLSA-2026-1793190394
Updated
2026-11-02
OSVCLSA-2026-1793190457 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.83.29-p6+tuxcare.

Record
CLSA-2026-1793190457
Updated
2026-11-02
OSVCLSA-2026-1793190676 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p6+tuxcare.

Record
CLSA-2026-1793190676
Updated
2026-11-02
OSVCLSA-2026-1793193622 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p4+tuxcare.

Record
CLSA-2026-1793193622
Updated
2026-11-02
OSVCLSA-2026-1793193692 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.51.0-p4+tuxcare.

Record
CLSA-2026-1793193692
Updated
2026-11-02
OSVCLSA-2026-1793200604 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.50.2-p4+tuxcare.

Record
CLSA-2026-1793200604
Updated
2026-11-02
OSVCLSA-2026-1793275323 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.3-p6+tuxcare.

Record
CLSA-2026-1793275323
Updated
2026-11-02
OSVCLSA-2026-1793788546 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.1-p6+tuxcare.

Record
CLSA-2026-1793788546
Updated
2026-11-04
OSVCLSA-2026-1793788759 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.0-p8+tuxcare.

Record
CLSA-2026-1793788759
Updated
2026-11-04
OSVCLSA-2026-1793788860 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 8.12.2-p6+tuxcare.

Record
CLSA-2026-1793788860
Updated
2026-11-04
OSVCLSA-2026-1793789039 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.7.29-p5+tuxcare.

Record
CLSA-2026-1793789039
Updated
2026-11-04
OSVCLSA-2026-1793789131 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 6.20.45-p7+tuxcare.

Record
CLSA-2026-1793789131
Updated
2026-11-04
OSVCLSA-2026-1793789396 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 7.30.7-p7+tuxcare.

Record
CLSA-2026-1793789396
Updated
2026-11-04
OSVCLSA-2026-1793793106 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.8.38-p9+tuxcare.

Record
CLSA-2026-1793793106
Updated
2026-11-04
OSVCLSA-2026-1793793277 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.6.40-p5+tuxcare.

Record
CLSA-2026-1793793277
Updated
2026-11-04
OSVCLSA-2026-1793807886 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.5.50-p5+tuxcare.

Record
CLSA-2026-1793807886
Updated
2026-11-04

Affected products

Affected packages

Affected packages
PackageAffectedFixed
laravel/framework
Packagist
 13.0.0 up to 13.29.0
13.29.0
laravel/framework
Packagist
 before 12.68.0
12.68.0
laravel/framework
TuxCare:Packagist
 10.48.28 up to 10.48.28-p3+tuxcare, plus listed versions
10.48.28-p1+tuxcare10.48.28-p2+tuxcare
10.48.28-p3+tuxcare
laravel/framework
TuxCare:Packagist
 11.44.0 up to 11.44.0-p4+tuxcare, plus listed versions
11.44.0-p1+tuxcare11.44.0-p2+tuxcare11.44.0-p3+tuxcare
11.44.0-p4+tuxcare
laravel/framework
TuxCare:Packagist
 10.48.29 up to 10.48.29-p2+tuxcare, plus listed versions
10.48.29-p1+tuxcare
10.48.29-p2+tuxcare
laravel/framework
TuxCare:Packagist
 8.83.29 up to 8.83.29-p6+tuxcare, plus listed versions
8.83.29-p1+tuxcare8.83.29-p2+tuxcare8.83.29-p3+tuxcare8.83.29-p4+tuxcare8.83.29-p5+tuxcare
8.83.29-p6+tuxcare
laravel/framework
TuxCare:Packagist
 12.58.0 up to 12.58.0-p6+tuxcare, plus listed versions
12.58.0-p1+tuxcare12.58.0-p2+tuxcare12.58.0-p3+tuxcare12.58.0-p4+tuxcare12.58.0-p5+tuxcare
12.58.0-p6+tuxcare
laravel/framework
TuxCare:Packagist
 9.52.21 up to 9.52.21-p4+tuxcare, plus listed versions
9.52.21-p1+tuxcare9.52.21-p2+tuxcare9.52.21-p3+tuxcare
9.52.21-p4+tuxcare
laravel/framework
TuxCare:Packagist
 11.51.0 up to 11.51.0-p4+tuxcare, plus listed versions
11.51.0-p1+tuxcare11.51.0-p2+tuxcare11.51.0-p3+tuxcare
11.51.0-p4+tuxcare
laravel/framework
TuxCare:Packagist
 10.50.2 up to 10.50.2-p4+tuxcare, plus listed versions
10.50.2-p1+tuxcare10.50.2-p3+tuxcare
10.50.2-p4+tuxcare
Show 15 moreShow less
Affected packages
PackageAffectedFixed
laravel/framework
TuxCare:Packagist
 8.12.3 up to 8.12.3-p6+tuxcare, plus listed versions
8.12.3-p1+tuxcare8.12.3-p2+tuxcare8.12.3-p3+tuxcare8.12.3-p4+tuxcare8.12.3-p5+tuxcare
8.12.3-p6+tuxcare
laravel/framework
TuxCare:Packagist
 8.12.1 up to 8.12.1-p6+tuxcare, plus listed versions
8.12.1-p1+tuxcare8.12.1-p2+tuxcare8.12.1-p3+tuxcare8.12.1-p4+tuxcare8.12.1-p5+tuxcare
8.12.1-p6+tuxcare
laravel/framework
TuxCare:Packagist
 8.12.0 up to 8.12.0-p8+tuxcare, plus listed versions
8.12.0-p1+tuxcare8.12.0-p3+tuxcare8.12.0-p4+tuxcare8.12.0-p5+tuxcare8.12.0-p6+tuxcare8.12.0-p7+tuxcare
8.12.0-p8+tuxcare
laravel/framework
TuxCare:Packagist
 8.12.2 up to 8.12.2-p6+tuxcare, plus listed versions
8.12.2-p1+tuxcare8.12.2-p2+tuxcare8.12.2-p3+tuxcare8.12.2-p4+tuxcare8.12.2-p5+tuxcare
8.12.2-p6+tuxcare
laravel/framework
TuxCare:Packagist
 5.7.29 up to 5.7.29-p5+tuxcare, plus listed versions
5.7.29-p1+tuxcare5.7.29-p2+tuxcare5.7.29-p3+tuxcare5.7.29-p4+tuxcare
5.7.29-p5+tuxcare
laravel/framework
TuxCare:Packagist
 6.20.45 up to 6.20.45-p7+tuxcare, plus listed versions
6.20.45-p1+tuxcare6.20.45-p2+tuxcare6.20.45-p3+tuxcare6.20.45-p4+tuxcare6.20.45-p5+tuxcare6.20.45-p6+tuxcare
6.20.45-p7+tuxcare
laravel/framework
TuxCare:Packagist
 7.30.7 up to 7.30.7-p7+tuxcare, plus listed versions
7.30.7-p1+tuxcare7.30.7-p2+tuxcare7.30.7-p3+tuxcare7.30.7-p4+tuxcare7.30.7-p5+tuxcare7.30.7-p6+tuxcare
7.30.7-p7+tuxcare
laravel/framework
TuxCare:Packagist
 5.8.38 up to 5.8.38-p9+tuxcare, plus listed versions
5.8.38-p1+tuxcare5.8.38-p2+tuxcare5.8.38-p3+tuxcare5.8.38-p4+tuxcare5.8.38-p5+tuxcare5.8.38-p6+tuxcare5.8.38-p7+tuxcare5.8.38-p8+tuxcare
5.8.38-p9+tuxcare
laravel/framework
TuxCare:Packagist
 5.6.40 up to 5.6.40-p5+tuxcare, plus listed versions
5.6.40-p1+tuxcare5.6.40-p2+tuxcare5.6.40-p3+tuxcare5.6.40-p4+tuxcare
5.6.40-p5+tuxcare
laravel/framework
TuxCare:Packagist
 5.5.50 up to 5.5.50-p5+tuxcare, plus listed versions
5.5.50-p1+tuxcare5.5.50-p2+tuxcare5.5.50-p3+tuxcare5.5.50-p4+tuxcare
5.5.50-p5+tuxcare
php-laravel-framework
Debian:12
 All versions, plus listed versions
10.48.25+dfsg-110.48.25+dfsg-210.48.29+dfsg-111.44.0-111.44.2+dfsg-1
Show 7 moreShow less
11.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-413.31.0+dfsg-113.31.0+dfsg-28.83.26+dfsg-2
 None known
php-laravel-framework
Debian:13
 All versions, plus listed versions
10.48.29+dfsg-111.44.0-111.44.2+dfsg-111.46.1+dfsg-111.46.1+dfsg-2
Show 4 moreShow less
11.46.1+dfsg-311.46.1+dfsg-413.31.0+dfsg-113.31.0+dfsg-2
 None known
php-laravel-framework
Debian:14
 before 13.31.0+dfsg-1, plus listed versions
10.48.29+dfsg-111.44.0-111.44.2+dfsg-111.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-4
13.31.0+dfsg-1
laravel/framework
Packagist
 13.0.0 up to 13.29.0, plus listed versions
v13.0.0v13.1.0v13.1.1v13.10.0v13.11.0
Show 31 moreShow less
v13.11.1v13.11.2v13.12.0v13.13.0v13.14.0v13.15.0v13.16.0v13.16.1v13.17.0v13.18.0v13.18.1v13.19.0v13.2.0v13.20.0v13.21.0v13.21.1v13.22.0v13.23.0v13.24.0v13.25.0v13.26.0v13.26.1v13.27.0v13.28.0v13.3.0v13.4.0v13.5.0v13.6.0v13.7.0v13.8.0v13.9.0
13.29.0
laravel/framework
Packagist
 before 12.68.0, plus listed versions
10.50.25.0.305.2.41v10.0.0v10.0.1
Show 45 moreShow less
v10.0.2v10.0.3v10.1.0v10.1.1v10.1.2v10.1.3v10.1.4v10.1.5v10.10.0v10.10.1v10.11.0v10.12.0v10.13.0v10.13.1v10.13.2v10.13.3v10.13.5v10.14.0v10.14.1v10.15.0v10.16.0v10.16.1v10.17.0v10.17.1v10.18.0v10.19.0v10.2.0v10.20.0v10.21.0v10.21.1v10.22.0v10.23.0v10.23.1v10.24.0v10.25.0v10.25.1v10.25.2v10.26.0v10.26.1v10.26.2v10.27.0v10.28.0v10.29.0v10.3.0v10.3.1
12.68.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubhakaioffsec/CVE-2026-114509-PoC2026-10-20
PoC in GitHubtajulasri/-CVE-2026-114509-POC2026-10-22
PoC in GitHubArioVeisa/cve-2026-114509-laravel-tokenguard2026-10-24
PoC in GitHubdimasma0305/CVE-2026-1145092026-10-24
PoC in GitHubNxploited/CVE-2026-1145092026-10-27
PoC in GitHubNguemoue/project2026_20261030_tokengate2026-10-30
PoC in GitHubnextmend/laravel-type-juggling-auth-bypass2026-11-01
NucleiLaravel TokenGuard - Authentication Bypass

History

History
RecordedChangedSources
affected, aliasesOSV
exploitsNuclei
affected, aliases, exploits, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-114509 is a critical vulnerability (CVSS 9.2) in Flarum Framework, published October 21, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in laravel/framework 13.29.0.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 1,199 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open