CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
https://github.com/laravel/framework/releases/tag/v12.68.0
https://github.com/laravel/framework/releases/tag/v13.29.0
https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

Configurations

No configuration.

History

21 Oct 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 22:16

Updated : 2026-10-28 19:17

NVD link : CVE-2026-114509

Mitre link : CVE-2026-114509

CVE.ORG link : CVE-2026-114509

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-1287

Improper Validation of Specified Type of Input

{"id": "CVE-2026-114509", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114509", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-28T18:32:04.286628Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "laravel", "product": "framework", "versions": [{"status": "affected", "version": "< 12.68.0"}, {"status": "affected", "version": ">= 13.0.0, < 13.29.0"}]}]}], "published": "2026-10-21T22:16:49.710", "references": [{"url": "https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5", "source": "security-advisories@github.com"}, {"url": "https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c", "source": "security-advisories@github.com"}, {"url": "https://github.com/laravel/framework/releases/tag/v12.68.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/laravel/framework/releases/tag/v13.29.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0."}], "lastModified": "2026-10-28T19:17:28.053", "sourceIdentifier": "security-advisories@github.com"}