Critical Laravel TokenGuard flaw lets attackers log in as any API user

Laravel, one of the most widely used PHP web frameworks, has published a critical security advisory for an authentication bypass in its built-in token-based API guard. Tracked as CVE-2026-114509 and rated 9.2 on CVSS v4, the flaw allows an unauthenticated attacker to be authenticated as an arbitrary existing user without knowing that user's API token, according to the advisory published on GitHub on October 19. The Hacker News highlighted the issue in its October 22 roundup.

What happened

The advisory, titled "Token-based API guard Auth Bypass" (GHSA-f9x3-7vq9-cph6), says Laravel's TokenGuard can be bypassed when it is configured as a standard token-based API guard. The project rates the issue critical and credits a researcher using the handle KIKOmanasijev with reporting it.

According to the advisory, an attacker can take over any account on routes protected by the affected guard. The CVSS vector indicates the attack is network-based, needs no privileges and no user interaction, and has a high impact on confidentiality, integrity and availability.

Technical details

The advisory says that on MySQL or MariaDB, an attacker can submit a specially crafted, non-string credential value. The authentication lookup mishandles that value, so the database query matches an unintended user record instead of failing. In practice, the attacker ends up authenticated as an existing user.

The bug affects laravel/framework versions below 13.29.0 and below 12.68.0. Those versions contain the fix. The advisory does not list any workaround, and no CWE is assigned. The Hacker News reported that the fix is in versions 13.29.0 and 12.68.0. Neither source reports exploitation in the wild.

Who is affected

Applications are exposed when all of the following apply, according to the advisory:

• They use Laravel's standard token-based API guard (TokenGuard).
• Their user data is stored in MySQL or MariaDB.
• They run a laravel/framework release older than the patched versions.

The advisory is limited to the framework's built-in TokenGuard; applications that do not use this guard for their APIs are not described as affected.

What to do

• Upgrade laravel/framework to 13.29.0 or 12.68.0 or later. Check the version actually installed with composer show laravel/framework, since version constraints in composer.json can hold back updates.
• Review config/auth.php to identify any guards that use the token driver.
• Because no workaround is offered, prioritize patching internet-facing APIs that rely on the token guard.
• After updating, review authentication and API access logs for unexpected sessions on token-protected routes.