CVE-2026-114509
CRITICAL
9,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
287
Improper Authentication
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Access Control
Potential Impacts:
Read Application Data
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, ICS/OT
1287
Improper Validation of Specified Type of Input
IncompleteCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
All platforms may be affected
https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f…
https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952…
https://github.com/laravel/framework/releases/tag/v12.68.0
https://github.com/laravel/framework/releases/tag/v13.29.0
https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6