#TokenGuard

Critical Laravel TokenGuard flaw lets attackers log in as any API user

Laravel has disclosed CVE-2026-114509, a CVSS 9.2 bypass in its token-based API guard that lets unauthenticated attackers impersonate existing users on MySQL and MariaDB.

2h ago