CVE-2026-114509— Laravel TokenGuard authentication bypass through non-string API credentials
Quick assessment
Affected
laravel framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Laravel 是一个 Web 应用程序框架。在 12.68.0 和 13.29.0 版本之前，当 TokenGuard 被配置为标准基于令牌的 API 守卫时，它不会拒绝精心构造的非字符串凭证。在受影响的 MySQL 或 MariaDB 配置下，身份验证查询可能意外匹配到已存在的用户，从而允许未认证的攻击者绕过身份验证，并接管由 TokenGuard 保护的路径上的账户。该问题已在 12.68.0 和 13.29.0 版本中修复。
Possible ATT&CK Techniques 2 AI
T1552.001 · Credentials In Files T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114509
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Laravel TokenGuard authentication bypass through non-string API credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114509
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114509
请登录查看更多情报信息。
Vendor Pages for CVE-2026-114509 (1)
-
🔗 Release v12.68.0 · laravel/framework · GitHub x_refsource_MISC
Other References for CVE-2026-114509 (4)
-
Release v13.29.0 · laravel/framework · GitHub x_refsource_MISC
-
Token-based API guard Auth Bypass · Advisory · laravel/framework · GitHub x_refsource_CONFIRM
-
fix token retrieval · laravel/framework@9b21ce0 · GitHub x_refsource_MISC
-
fix token retrieval · laravel/framework@8dbb08b · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: framework
-
CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data -
CVE-2026-110803
Session Lock Leak on an Invalid UI Id Allows Denial of Servi -
CVE-2026-102279
Laravel: XSS in Debug Page Information -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototyp
Same vendor: laravel
-
CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data -
CVE-2026-102279
Laravel: XSS in Debug Page Information -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-73683
Laravel Socialite Facebook Provider Authentication Bypass vi -
CVE-2026-39976
Laravel Passport's TokenGuard Authenticates Unrelated User f
Same weakness: CWE-287
-
CVE-2026-114222
NewType Infortech｜NT OneAPP - Authentication Bypass -
CVE-2026-114638
Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls- -
CVE-2026-114639
Traefik before 2.11.58 and 3.7.14 Authentication Bypass via -
CVE-2026-114438
Keycloak-services: keycloak-services: required otp enrollmen -
CVE-2026-76474
Cisco Unified Communications Products Hardening Release: Oct
V. Comments for CVE-2026-114509
No comments yet