Laravel Framework Flaw Allows Authentication Bypass

What happened

Laravel has patched an authentication bypass in Laravel Framework, the software developers use to build web applications. Think of it like a front desk accepting the wrong kind of identification and then handing someone the key to another guest's room. Under specific conditions, the framework's TokenGuard can accept an unexpected kind of credential and mistakenly authenticate a request as an existing user.

The issue, tracked as CVE-2026-114509, affects Laravel Framework versions earlier than 12.68.0 and versions >= 13.0.0 and < 13.29.0. The vendor's advisory identifies 12.68.0 and later and 13.29.0 and later as the respective fixed releases. The vulnerable behavior involves TokenGuard configured for standard token-based API authentication, together with affected MySQL or MariaDB configurations.

NVD published the vulnerability on 2026-10-21 and assigns it a CRITICAL severity rating. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-23. CVE-2026-114509 is not listed in the CISA Known Exploited Vulnerabilities catalog, commonly called KEV, as of the catalog check.

Technical details

TokenGuard is the component involved in checking a token supplied with a request to decide which user, if any, should be authenticated. An API, or application programming interface, lets software exchange requests and responses. In the affected configuration, TokenGuard expects a token credential but does not reject a crafted value that is not a string, meaning a text value. That missing type check is central to the flaw.

NVD associates the vulnerability with CWE-1287, Improper Validation of Specified Type of Input, and CWE-287, Improper Authentication. CWE stands for Common Weakness Enumeration, a system for categorizing software weaknesses. Here, the categories describe a connected failure: an unexpected input type reaches the authentication lookup, and that lookup can incorrectly identify an existing user.

Exploitation requires the affected TokenGuard configuration and affected MySQL or MariaDB configurations. In that setting, a crafted non-string credential can cause the authentication lookup to match a user the requester should not be able to access. An unauthenticated attacker can then bypass authentication and take over an account on routes protected by TokenGuard. Routes are the application endpoints that receive requests. The advisory does not establish that every Laravel Framework application, database configuration, or authentication method is affected in the same way.

The CVSS score is 9.2 under CVSS version 4.0, with a CRITICAL severity rating. CVSS, the Common Vulnerability Scoring System, summarizes the technical severity of a vulnerability. This rating supports prioritizing the update, but it does not establish whether a particular application meets the attack conditions or whether exploitation has occurred.

Who is affected

Everyday users

For everyday users, the concern is an application confusing an attacker's request with a legitimate user's account. If a service uses the affected Laravel Framework setup, the flaw can undermine the login protection on its TokenGuard-protected endpoints. The specific account capabilities exposed depend on the application; the advisory does not identify particular services or describe what each account can do.

The repair belongs with the organization running the application. Users cannot confirm that a service is fixed simply because its login screen looks normal. If you need assurance about a service you use, ask its operator whether it has reviewed CVE-2026-114509 and deployed an applicable fixed Laravel Framework release.

Developers

Developers should establish both the installed Laravel Framework version and how the application authenticates API requests. An affected package version is a reason to update, while the use of standard token-based TokenGuard authentication and an affected MySQL or MariaDB configuration determines whether the described attack conditions apply.

The underlying development lesson is specific: authentication input needs a valid type before it participates in a user lookup. For this advisory, the supported repair is the fixed framework release. Follow the update steps in the vendor's advisory, then check the behavior of your TokenGuard-protected endpoints with legitimate credentials and unexpected credential types.

Server and IT admins

Server and IT admins should connect their Laravel Framework package inventory with the applications actually running on their servers. Prioritize deployments that use TokenGuard for standard token-based API authentication with MySQL or MariaDB, and review the vendor's advisory to determine whether the database configuration is affected.

Coordinate the package update with the team responsible for application deployment. Confirm that the updated application has reached the running environment, rather than relying only on an updated development copy. Treat the CRITICAL rating as a reason for prompt review while using the application's actual configuration to assess exposure.

What to do now

1. Identify applications running Laravel Framework and check their installed framework versions using an applicable command below.
2. Compare each installed version with the affected ranges: earlier than 12.68.0, or >= 13.0.0 and < 13.29.0.
3. Review whether each application uses TokenGuard as a standard token-based API guard and whether its MySQL or MariaDB configuration meets the conditions described in the vendor's advisory.
4. Follow the update steps in the vendor's advisory. For the respective release lines, move to 12.68.0 and later or 13.29.0 and later. If using the package update command below, confirm that dependency constraints allow an applicable fixed version to be installed.
5. Deploy the updated application and verify the installed framework version in the running environment.
6. Check that legitimate token authentication still works and that non-string credentials are rejected on the affected TokenGuard authentication path.

php artisan --version

composer show laravel/framework

composer update laravel/framework

If you can't update yet

• Check the vendor advisory for guidance on temporarily restricting access to affected TokenGuard-protected endpoints or reducing their internet exposure while preparing the update.

How to confirm the fix

• Check the installed Laravel Framework version after deployment and confirm it falls within the applicable fixed range: 12.68.0 and later or 13.29.0 and later.
• Confirm that the deployed application is using the updated framework package, including each running instance that serves the affected endpoints.
• In an authorized test environment, verify that valid token credentials still authenticate as expected and that non-string credentials are rejected without authenticating as an existing user.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 2 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Laravel advisory: https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
• NVD: CVE-2026-114509
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 23, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.