CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

What is affected

Laravel’s built-in TokenGuard — the simple token API guard configured in config/auth.php — in laravel/framework versions before 12.68.0 and, on the 13.x line, before 13.29.0. The advisory names MySQL and MariaDB as the affected database configurations. Laravel Sanctum and Laravel Passport use their own guards and are not named in the advisory.

How the bypass works

TokenGuard looks up the user whose stored API token matches the token sent with the request. Before the fix it did not insist that the submitted token was a plain string. A crafted value of another type is mishandled during the database lookup on affected MySQL/MariaDB setups, so the query matches an existing user it should not. The attacker is then signed in as that user without knowing their token.

Impact

An unauthenticated attacker can act as another user on every route protected by the affected guard — reading and changing that user’s data, and taking over the account. If the matched account has elevated rights, the attacker gets those too.

The fix

The patched TokenGuard requires a non-empty string token before it queries the user provider, and rejects missing or non-string credentials when validating. See the Laravel security advisory and the release notes for v12.68.0 and v13.29.0.

Read our full walkthrough of this Laravel TokenGuard bypass for the affected-or-not checklist, the upgrade commands, a temporary middleware and log checks.