Laravel fixes an API token bypass that hands over any account

Laravel fixes an API token bypass that hands over any account

19 October 2026: Laravel has fixed CVE-2026-114509, a critical flaw (CVSS 4.0 score 9.2) in its built-in TokenGuard that lets an attacker who is not logged in authenticate as an existing user without that user's API token, on applications backed by MySQL or MariaDB. The fix is in laravel/framework 13.29.0 and 12.68.0, and Italy's national CSIRT warned on 22 October that a proof of concept is now available.

Not yet independently verified. Laravel does not say which MySQL or MariaDB settings make the bypass work, and neither it nor Italy's ACN reports exploitation so far. We will update this when it can be confirmed, and remove this note.

Fixed versions

• Laravel 13: 13.29.0 or later
• Laravel 12: 12.68.0 or later

Laravel published the advisory on GitHub on 19 October. It lists no workaround, so upgrading is the fix.

How the bypass works

TokenGuard is the simple token guard that ships with the framework: an API client sends a token, and the guard looks up the user whose stored token matches. According to the advisory, the guard does not check that the credential it receives is a string. Under certain MySQL and MariaDB configurations, an attacker can send a crafted non-string value that is mishandled in the lookup, so the database query matches a user record it should not instead of failing. The attacker is then authenticated as that existing user, with no login and no user interaction, on every route the guard protects.

The CVSS vector marks an attack precondition, which reflects the database dependency: applications on PostgreSQL or SQLite are not named as affected, and applications that use Sanctum or Passport for API authentication rather than the plain token guard are not the target described. The flaw was reported by the researcher KIKOmanasijev.

Who needs to move first

Italy's ACN rates the systemic impact critical (78.46) and notes that the proof of concept is public, while its exploitation field is still empty. Laravel is one of the most widely used PHP frameworks for business applications, internal tools and SaaS back ends, and many of those expose token-protected API routes to the internet. Teams should check two things: whether any guard in config/auth.php uses the token driver, and whether the application runs on MySQL or MariaDB. Where both are true the upgrade is urgent, and API access logs from before it are worth reviewing for requests that authenticated with malformed token values. The same week's PHP emergency release means many Laravel servers need a runtime update as well as the framework one.

Related on TrustList:

• PHP fixes two critical remote code execution flaws, update now
• Craft CMS sites need 5.11.0 or 4.18.8 to close Twig sandbox code flaws
• CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

Sources

• Laravel on GitHub: Token-based API guard Auth Bypass (GHSA-f9x3-7vq9-cph6), 19 October 2026
• ACN (Italy): Laravel, disponibile PoC per lo sfruttamento della CVE-2026-114509 (AL02/261022/CSIRT-ITA), 22 October 2026