Laravel TokenGuard bypass (CVE-2026-114509): how attackers log in as your users, and how to fix it

In short: CVE-2026-114509 is a critical flaw in Laravel’s built-in TokenGuard. On MySQL or MariaDB, an attacker can send a specially shaped API token and be logged in as one of your existing users — without knowing their token. Upgrade laravel/framework to 12.68.0 or 13.29.0 (or later).

What happened

On 19 October 2026 the Laravel team published a security advisory, “Token-based API guard Auth Bypass” (GHSA-f9x3-7vq9-cph6), and the CVE followed on 21 October. It is rated Critical — CVSS v4.0 9.2. The issue was reported by the researcher KIKOmanasijev.

It is not on CISA’s Known Exploited Vulnerabilities list at the time of writing, but the advisory, the fix and write-ups are all public, so attackers can study exactly what changed. Treat it as urgent if your app uses the affected guard.

Who is affected

You are affected only if all three of these are true:

1. your app runs laravel/framework below 12.68.0, or a 13.x release below 13.29.0;
2. it authenticates API requests with Laravel’s built-in token guard (TokenGuard); and
3. its database is MySQL or MariaDB, the configurations named in the advisory.

Laravel Sanctum and Passport use their own guards and are not named in the advisory. Session (browser) login is a different guard and is not part of this issue.

Check in two commands:

# 1. Which Laravel version?
composer show laravel/framework | grep versions

# 2. Do you use the token guard?
grep -n "'driver' => 'token'" config/auth.php

How the attack works

With the token guard, a client proves who it is by sending its API token — in the query string, the request body or the Authorization: Bearer header. Laravel then looks up the user whose stored token matches.

Before the fix, TokenGuard did not insist that the submitted token was plain text. A request can carry other kinds of values, for example in a JSON body. On affected MySQL and MariaDB setups, such a crafted value is mishandled during the database lookup, and the query matches an existing user it should not. Laravel then treats the attacker as that user.

In practice that means:

• no password or token needed — the attacker only needs to reach your API;
• account takeover on every route protected by the guard: reading, changing or deleting that user’s data;
• if the matched account is an administrator or a service account, the attacker inherits those powers.

How to fix it

1. Upgrade Laravel to 12.68.0 or 13.29.0 or later, run your tests, and deploy.
2. On Laravel 11 or older, there is no patch for this branch: upgrade to Laravel 12 or 13, or move API authentication to Sanctum.
3. Rotate API tokens once patched, in case any were abused.
4. Update PHP too. The same week brought the critical “PHP2Shell” flaws in PHP itself — see PHP2Shell explained. Laravel Forge notes that its automatic security updates do not upgrade PHP, so check your servers.

composer update laravel/framework
composer show laravel/framework   # should show 12.68.0+ or 13.29.0+
php artisan optimize:clear

If you cannot upgrade today

As a short-term guard, reject any request whose API token is not a plain string before Laravel’s authentication runs. This is a stop-gap, not a replacement for the upgrade:

<?php
// app/Http/Middleware/RejectNonStringApiToken.php
namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class RejectNonStringApiToken
{
    public function handle(Request $request, Closure $next)
    {
        foreach ([$request->query('api_token'), $request->input('api_token')] as $token) {
            if ($token !== null && ! is_string($token)) {
                abort(401);
            }
        }

        return $next($request);
    }
}

Register it so it runs before the auth:api middleware on your API routes.

How to check whether you were targeted

• Search API and web-server logs for requests where api_token was sent as something other than text — for example a number, true/false, an array or a nested JSON object.
• Look for logins to accounts from unfamiliar IP addresses, and for activity on accounts that do not normally use the API.
• Review recent changes made through the API: new users, changed e-mail addresses or passwords, new tokens, and data exports.
• If you find signs of abuse: rotate all API tokens, reset affected accounts, and review what data those accounts could reach.

Key takeaways

• Authentication code must check the type of what it receives, not just its value.
• Keep frameworks on a supported release line so security fixes reach you.
• Patch the whole stack — the framework and the PHP runtime underneath it.

Sources

• Laravel security advisory GHSA-f9x3-7vq9-cph6: Token-based API guard Auth Bypass
• NIST NVD: CVE-2026-114509
• Laravel v12.68.0 release and v13.29.0 release
• Laravel Forge: PHP security advisory (October 2026)

Track the record on GhostLayer: CVE-2026-114509.