Read the docs
TI-2026-79037 Aliases CVE-2026-114509GHSA-f9x3-7vq9-cph6

Authentication bypass in Laravel TokenGuard via non-string input

Priority MEDIUM 45CWE-1287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Laravel framework before 12.68.0 and from 13.0.0 before 13.29.0 is affected. TokenGuard does not reject a crafted non-string credential, so under affected MySQL or MariaDB configurations the lookup can match an unintended user (CWE-1287). An unauthenticated remote attacker can bypass authentication and take over an account on routes protected by TokenGuard.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0184 79th percentileScored 2026-11-07
Fix Fixed framework (laravel): 12.68.0, 13.29.0laravel/framework (Packagist): 13.29.0, 12.68.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Laravelframeworkbefore 12.68.0; 13.0.0 to before 13.29.012.68.0, 13.29.0Patch availableCNA
—laravel/framework (Packagist)13.0.0 to before 13.29.013.29.0Patch availableGHSA-f9x3-7vq9-cph6
—laravel/framework (Packagist)before 12.68.012.68.0Patch availableGHSA-f9x3-7vq9-cph6
  • framework VendorLaravel Affected before 12.68.0; 13.0.0 to before 13.29.0 Fixed in 12.68.0, 13.29.0 Patch available CNA
  • laravel/framework (Packagist) Vendor— Affected 13.0.0 to before 13.29.0 Fixed in 13.29.0 Patch available GHSA-f9x3-7vq9-cph6
  • laravel/framework (Packagist) Vendor— Affected before 12.68.0 Fixed in 12.68.0 Patch available GHSA-f9x3-7vq9-cph6

Remediation

Upgrade the laravel/framework Packagist package to 12.68.0 on the 12.x line or to 13.29.0 on the 13.x line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA framework (laravel) Fixed in 12.68.0, 13.29.0
  • Fix · GHSA-f9x3-7vq9-cph6 laravel/framework (Packagist) Fixed in 13.29.0 Advisory →
  • Fix · GHSA-f9x3-7vq9-cph6 laravel/framework (Packagist) Fixed in 12.68.0 Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114509
  2. 2026-10-23 Alias added: GHSA-f9x3-7vq9-cph6
  3. 2026-10-23 Fix available: Packagist/laravel/[email protected], Packagist/laravel/[email protected] · GHSA-f9x3-7vq9-cph6
  4. 2026-10-23 CVSS score added · GHSA-f9x3-7vq9-cph6
  5. 2026-10-23 Weakness changed · GHSA-f9x3-7vq9-cph6
  6. 2026-10-23 7 new references · GHSA-f9x3-7vq9-cph6
  7. 2026-10-25 EPSS moved to the 50th–90th percentile
  8. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

Other 6

  • TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33912 Livewire vulnerable to remote command execution during property update hydration KEVCVSS 4.0CRITICAL 9.2
  • TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
  • TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
  • TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences