Laravel TokenGuard authentication bypass through non-string API credentials
CVE-2026-114509
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.
Proof-of-concept code is published
Public PoC
- Public PoChakaioffsec/CVE-2026-114509-PoC12 stars
- Public PoCtajulasri/-CVE-2026-114509-POC1 stars
- Public PoCdimasma0305/CVE-2026-114509
- Public PoCArioVeisa/cve-2026-114509-laravel-tokenguard
- Public PoCNxploited/CVE-2026-114509
- Public PoCNguemoue/project2026_20261030_tokengate
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 9.2 (v4.0)
- Severity
- Critical
- EPSS
- 0.00777% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- composer · laravel/framework
- Weakness
- CWE-1287, CWE-287
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://nvd.nist.gov/vuln/detail/CVE-2026-114509
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.29.0
- https://github.com/advisories/GHSA-f9x3-7vq9-cph6
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-114509