CVE-2026-114509: Laravel TokenGuard Auth Bypass Vulnerability

CVE-2026-114509 Overview

CVE-2026-114509 is an authentication bypass vulnerability in the Laravel web application framework. The flaw resides in the TokenGuard class when configured as a standard token-based API guard. Prior to versions 12.68.0 and 13.29.0, TokenGuard fails to reject non-string credentials submitted by a client. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user. An unauthenticated attacker can abuse this behavior to take over accounts on routes protected by TokenGuard. The weakness is classified as Improper Authentication [CWE-287].

Critical Impact

Unauthenticated attackers can bypass API authentication and take over accounts on routes protected by Laravel's TokenGuard.

Affected Products

• Laravel Framework versions prior to 12.68.0
• Laravel Framework versions prior to 13.29.0
• Applications using TokenGuard with MySQL or MariaDB backends

Discovery Timeline

• 2026-10-21 - CVE-2026-114509 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114509

Vulnerability Analysis

Laravel's TokenGuard reads a bearer token or API token from the incoming request and queries the configured user provider for a matching credential. The pre-patch code only checked that the token was not empty before passing it to retrieveByCredentials(). When a client submits a non-string value, such as an array, the token is forwarded unchanged to the underlying database query. Under certain MySQL and MariaDB configurations, the resulting SQL comparison can coerce the value and match an arbitrary existing user record. The guard then authenticates the request as that unintended user, granting access to any route protected by the API guard.

Root Cause

The root cause is missing type validation on the credential value inside src/Illuminate/Auth/TokenGuard.php. The guard relied on ! empty($token) without confirming that $token was a string before using it as a lookup key.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker crafts an HTTP request that supplies the API token parameter as a non-string type, such as a query-string array (?api_token[]=) or JSON array. The malformed credential bypasses the emptiness check and reaches the database lookup, where type coercion resolves it to a valid user.

        $token = $this->getTokenForRequest();

-        if (! empty($token)) {
+        if (is_string($token) && ! empty($token)) {
            $user = $this->provider->retrieveByCredentials([
                $this->storageKey => $this->hash ? hash('sha256', $token) : $token,
            ]);

Source: GitHub Commit 8dbb08b and GitHub Commit 9b21ce0. The patch adds an is_string($token) check so that only scalar string tokens are forwarded to the user provider.

Detection Methods for CVE-2026-114509

Indicators of Compromise

• HTTP requests containing array-style api_token[] parameters in query strings or form bodies
• JSON request bodies where api_token is an array or object rather than a string
• Authentication events on TokenGuard-protected routes without a preceding credential issuance
• Unexpected authenticated sessions originating from unfamiliar IP addresses hitting API endpoints

Detection Strategies

• Inspect web server and application logs for request parameters where api_token is submitted as a non-string value.
• Add logging in Laravel middleware to flag calls to TokenGuard::user() when the raw token input fails an is_string() check.
• Review database query logs for authentication lookups that return a user without a prior login or token-issue event.

Monitoring Recommendations

• Monitor API gateways and WAFs for query parameters matching the pattern api_token[.
• Alert on authentication success events for API routes where the client has never been issued a valid token.
• Baseline normal TokenGuard request volumes and alert on anomalous spikes against account-related endpoints.

How to Mitigate CVE-2026-114509

Immediate Actions Required

• Upgrade Laravel to version 12.68.0 or 13.29.0 or later without delay.
• Audit all application routes that use the token guard driver and inventory privileged endpoints.
• Review authentication and account-change logs for suspicious access since the vulnerable version was deployed.
• Rotate API tokens for all users if evidence of exploitation is found.

Patch Information

The Laravel maintainers released fixed builds in GitHub Release v12.68.0 and GitHub Release v13.29.0. The fix is documented in GitHub Security Advisory GHSA-f9x3-7vq9-cph6. Apply the upgrade with Composer and redeploy affected applications.

Workarounds

• Add middleware that rejects requests where api_token is not a scalar string before reaching TokenGuard.
• Enforce strict typing at the web server, API gateway, or WAF layer to block array-style api_token[] parameters.
• Switch affected routes to Laravel Sanctum or Passport until the framework upgrade can be deployed.

# Upgrade Laravel via Composer to a patched release
composer require laravel/framework:^12.68.0
# or, for the 13.x branch
composer require laravel/framework:^13.29.0

# Verify installed version
php artisan --version