Auth bypass in Laravel Framework
CVE-2026-114509
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Vulnerability class: Broken Authentication
Published · last modified .
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Laravel Framework — versions < 12.68.0, >= 13.0.0, < 13.29.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- github.com/laravel/framework/releases/tag/v12.68.0
- github.com/laravel/framework/releases/tag/v13.29.0
Frequently asked questions
- What is CVE-2026-114509?
- CVE-2026-114509 is a vulnerability in Laravel Framework, classified under Improper Authentication. Published 2026-10-21.
- Is CVE-2026-114509 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.