CVE-2026-114509

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114509
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114509.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114509
Aliases
  • GHSA-f9x3-7vq9-cph6
Published
2026-10-21T21:49:29Z
Modified
2026-10-22T10:46:15Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Laravel TokenGuard authentication bypass through non-string API credentials
Details

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1287",
        "CWE-287"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114509.json"
}
References

Affected packages

Git / github.com/laravel/framework

Affected ranges

Type
GIT
Repo
https://github.com/laravel/framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1343c22b92edd48e29ff273d8ce7c15cf75d974c
Introduced
3e33f431a05365d008742ff8001b92641086d5f8
Fixed
6e2c363716964d8238cee7097b258119a984f0cf
Fixed
8dbb08bccac1be095dba4a9d259a419620f1e8a5
Fixed
9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "12.68.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "13.0.0"
                },
                {
                    "fixed":  "13.29.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "8dbb08bccac1be095dba4a9d259a419620f1e8a5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "9b21ce0a9bb2b2599978bc0b0df4abea952ad31c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v12.68.0",
            "range":  [
                {
                    "fixed":  "1343c22b92edd48e29ff273d8ce7c15cf75d974c"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v13.29.0",
            "range":  [
                {
                    "fixed":  "6e2c363716964d8238cee7097b258119a984f0cf"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v12.*
v12.0.0
v12.0.1
v12.1.0
v12.1.1
v12.10.0
v12.10.1
v12.10.2
v12.11.0
v12.11.1
v12.12.0
v12.13.0
v12.14.0
v12.14.1
v12.15.0
v12.16.0
v12.17.0
v12.18.0
v12.19.0
v12.19.1
v12.19.2
v12.19.3
v12.2.0
v12.20.0
v12.21.0
v12.22.0
v12.22.1
v12.23.0
v12.23.1
v12.24.0
v12.25.0
v12.26.0
v12.26.1
v12.26.2
v12.26.3
v12.26.4
v12.27.1
v12.28.0
v12.28.1
v12.29.0
v12.3.0
v12.30.0
v12.30.1
v12.31.0
v12.31.1
v12.32.0
v12.32.1
v12.32.2
v12.32.3
v12.32.4
v12.32.5
v12.33.0
v12.34.0
v12.35.0
v12.35.1
v12.36.0
v12.36.1
v12.37.0
v12.38.0
v12.38.1
v12.39.0
v12.4.0
v12.4.1
v12.40.0
v12.40.1
v12.40.2
v12.41.0
v12.41.1
v12.42.0
v12.43.0
v12.43.1
v12.44.0
v12.45.0
v12.45.1
v12.45.2
v12.46.0
v12.47.0
v12.48.0
v12.48.1
v12.49.0
v12.5.0
v12.50.0
v12.51.0
v12.52.0
v12.53.0
v12.54.0
v12.54.1
v12.55.0
v12.55.1
v12.56.0
v12.57.0
v12.58.0
v12.59.0
v12.6.0
v12.60.0
v12.60.1
v12.60.2
v12.61.0
v12.61.1
v12.62.0
v12.63.0
v12.64.0
v12.65.0
v12.66.0
v12.67.0
v12.7.0
v12.7.1
v12.7.2
v12.8.0
v12.8.1
v12.9.0
v12.9.1
v12.9.2
v13.*
v13.0.0
v13.1.0
v13.1.1
v13.10.0
v13.11.0
v13.11.1
v13.11.2
v13.12.0
v13.13.0
v13.14.0
v13.15.0
v13.16.0
v13.16.1
v13.17.0
v13.18.0
v13.18.1
v13.19.0
v13.2.0
v13.20.0
v13.21.0
v13.21.1
v13.22.0
v13.23.0
v13.24.0
v13.25.0
v13.26.0
v13.26.1
v13.3.0
v13.4.0
v13.5.0
v13.6.0
v13.7.0
v13.8.0
v13.9.0
v4.*
v4.0.0
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.1.0
v5.*
v5.5.0
v5.5.1
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.1.0
v8.11.0
v8.11.1
v8.11.2
v8.12.0
v8.12.1
v8.12.2
v8.12.3
v8.13.0
v8.14.0
v8.15.0
v8.16.0
v8.17.0
v8.17.1
v8.17.2
v8.2.0
v8.3.0
v8.4.0
v8.5.0
v8.6.0
v8.7.0
v8.7.1
v8.8.0
v8.9.0
v9.*
v9.0.0-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114509.json"