CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114509?
CVE-2026-114509 is a critical vulnerability in laravel framework, published on 21 Oct 2026.
Official description
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Which versions are affected by CVE-2026-114509?
4 open source packages ship an affected version, including laravel/framework.
| Package | Affected | Fixed in |
|---|---|---|
laravel/framework Packagist | All versions | 12.68.0 |
laravel/framework Packagist | All versions | 12.68.0 |
laravel/framework Packagist | From 13.0.0 | 13.29.0 |
laravel/framework Packagist | From 13.0.0 | 13.29.0 |
How do I fix CVE-2026-114509?
Upgrade laravel/framework to a fixed version for your release line: 12.68.0 or 13.29.0.
Is CVE-2026-114509 being exploited?
There is no known exploitation of CVE-2026-114509 in the wild and no public exploit code.
Public exploit code: 6 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1793031697, CLSA-2026-1793092408, CLSA-2026-1793190394, CLSA-2026-1793190457, CLSA-2026-1793190676, CLSA-2026-1793193622 and 4 more.