GHSA-f9x3-7vq9-cph6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-f9x3-7vq9-cph6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-f9x3-7vq9-cph6
- Aliases
- Published
- 2026-10-23T21:50:27Z
- Modified
- 2026-10-23T22:00:04Z
- Severity
-
- 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Laravel TokenGuard authentication bypass through non-string API credentials
- Details
-
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.
Impact
An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.
- Database specific
{ "cwe_ids": [ "CWE-1287", "CWE-287" ], "github_reviewed": true, "github_reviewed_at": "2026-10-23T21:50:27Z", "nvd_published_at": "2026-10-21T22:16:49Z", "severity": "CRITICAL" }- References
-
- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://nvd.nist.gov/vuln/detail/CVE-2026-114509
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.29.0
Affected packages
Packagist / laravel/framework
Package
- Name
- laravel/framework
- Purl
- pkg:composer/laravel/framework
Affected versions
v13.*
v13.0.0
v13.1.0
v13.1.1
v13.2.0
v13.3.0
v13.4.0
v13.5.0
v13.6.0
v13.7.0
v13.8.0
v13.9.0
v13.10.0
v13.11.0
v13.11.1
v13.11.2
v13.12.0
v13.13.0
v13.14.0
v13.15.0
v13.16.0
v13.16.1
v13.17.0
v13.18.0
v13.18.1
v13.19.0
v13.20.0
v13.21.0
v13.21.1
v13.22.0
v13.23.0
v13.24.0
v13.25.0
v13.26.0
v13.26.1
v13.27.0
v13.28.0
Packagist / laravel/framework
Package
- Name
- laravel/framework
- Purl
- pkg:composer/laravel/framework
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed12.68.0
Affected versions
v4.*
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.0.10
v4.0.11
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.15
v4.1.16
v4.1.17
v4.1.18
v4.1.19
v4.1.20
v4.1.21
v4.1.22
v4.1.23
v4.1.24
v4.1.25
v4.1.26
v4.1.27
v4.1.28
v4.1.29
v4.1.30
v4.1.31
v4.2.0-BETA1
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v4.2.9
v4.2.10
v4.2.11
v4.2.12
v4.2.13
v4.2.14
v4.2.15
v4.2.16
v4.2.17
v4.2.18
v4.2.19
v4.2.20
v4.2.21
v4.2.22
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v5.0.10
v5.0.11
v5.0.12
v5.0.13
v5.0.14
v5.0.15
v5.0.16
v5.0.17
v5.0.18
v5.0.19
v5.0.20
v5.0.21
v5.0.22
v5.0.23
v5.0.24
v5.0.25
v5.0.26
v5.0.27
v5.0.28
v5.0.29
v5.0.31
v5.0.32
v5.0.33
v5.0.34
v5.0.35
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.1.9
v5.1.10
v5.1.11
v5.1.12
v5.1.13
v5.1.14
v5.1.15
v5.1.16
v5.1.17
v5.1.18
v5.1.19
v5.1.20
v5.1.21
v5.1.22
v5.1.23
v5.1.24
v5.1.25
v5.1.26
v5.1.27
v5.1.28
v5.1.29
v5.1.30
v5.1.31
v5.1.32
v5.1.33
v5.1.34
v5.1.35
v5.1.36
v5.1.37
v5.1.38
v5.1.39
v5.1.40
v5.1.41
v5.1.42
v5.1.43
v5.1.44
v5.1.45
v5.1.46
v5.2.0-beta1
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.2.7
v5.2.8
v5.2.9
v5.2.10
v5.2.11
v5.2.12
v5.2.13
v5.2.14
v5.2.15
v5.2.16
v5.2.17
v5.2.18
v5.2.19
v5.2.20
v5.2.21
v5.2.22
v5.2.23
v5.2.24
v5.2.25
v5.2.26
v5.2.27
v5.2.28
v5.2.29
v5.2.30
v5.2.31
v5.2.32
v5.2.33
v5.2.34
v5.2.35
v5.2.36
v5.2.37
v5.2.38
v5.2.39
v5.2.40
v5.2.42
v5.2.43
v5.2.44
v5.2.45
v5.3.0-RC1
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.3.8
v5.3.9
v5.3.10
v5.3.11
v5.3.12
v5.3.13
v5.3.14
v5.3.15
v5.3.16
v5.3.17
v5.3.18
v5.3.19
v5.3.20
v5.3.21
v5.3.22
v5.3.23
v5.3.24
v5.3.25
v5.3.26
v5.3.27
v5.3.28
v5.3.29
v5.3.30
v5.3.31
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.4.7
v5.4.8
v5.4.9
v5.4.10
v5.4.11
v5.4.12
v5.4.13
v5.4.14
v5.4.15
v5.4.16
v5.4.17
v5.4.18
v5.4.19
v5.4.20
v5.4.21
v5.4.22
v5.4.23
v5.4.24
v5.4.25
v5.4.26
v5.4.27
v5.4.28
v5.4.29
v5.4.30
v5.4.31
v5.4.32
v5.4.33
v5.4.34
v5.4.35
v5.4.36
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.5.7
v5.5.8
v5.5.9
v5.5.10
v5.5.11
v5.5.12
v5.5.13
v5.5.14
v5.5.15
v5.5.16
v5.5.17
v5.5.18
v5.5.19
v5.5.20
v5.5.21
v5.5.22
v5.5.23
v5.5.24
v5.5.25
v5.5.26
v5.5.27
v5.5.28
v5.5.29
v5.5.30
v5.5.31
v5.5.32
v5.5.33
v5.5.34
v5.5.35
v5.5.36
v5.5.37
v5.5.38
v5.5.39
v5.5.40
v5.5.41
v5.5.42
v5.5.43
v5.5.44
v5.5.45
v5.5.46
v5.5.47
v5.5.48
v5.5.49
v5.5.50
v5.6.0
v5.6.1
v5.6.2
v5.6.3
v5.6.4
v5.6.5
v5.6.6
v5.6.7
v5.6.8
v5.6.9
v5.6.10
v5.6.11
v5.6.12
v5.6.13
v5.6.14
v5.6.15
v5.6.16
v5.6.17
v5.6.18
v5.6.19
v5.6.20
v5.6.21
v5.6.22
v5.6.23
v5.6.24
v5.6.25
v5.6.26
v5.6.27
v5.6.28
v5.6.29
v5.6.30
v5.6.31
v5.6.32
v5.6.33
v5.6.34
v5.6.35
v5.6.36
v5.6.37
v5.6.38
v5.6.39
v5.6.40
v5.7.0
v5.7.1
v5.7.2
v5.7.3
v5.7.4
v5.7.5
v5.7.6
v5.7.7
v5.7.8
v5.7.9
v5.7.10
v5.7.11
v5.7.12
v5.7.13
v5.7.14
v5.7.15
v5.7.16
v5.7.17
v5.7.18
v5.7.19
v5.7.20
v5.7.21
v5.7.22
v5.7.23
v5.7.24
v5.7.25
v5.7.26
v5.7.27
v5.7.28
v5.7.29
v5.8.0
v5.8.1
v5.8.2
v5.8.3
v5.8.4
v5.8.5
v5.8.6
v5.8.7
v5.8.8
v5.8.9
v5.8.10
v5.8.11
v5.8.12
v5.8.13
v5.8.14
v5.8.15
v5.8.16
v5.8.17
v5.8.18
v5.8.19
v5.8.20
v5.8.21
v5.8.22
v5.8.23
v5.8.24
v5.8.25
v5.8.26
v5.8.27
v5.8.28
v5.8.29
v5.8.30
v5.8.31
v5.8.32
v5.8.33
v5.8.34
v5.8.35
v5.8.36
v5.8.37
v5.8.38
5.*
5.0.30
5.2.41
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.1.0
v6.2.0
v6.3.0
v6.4.0
v6.4.1
v6.5.0
v6.5.1
v6.5.2
v6.6.0
v6.6.1
v6.6.2
v6.7.0
v6.8.0
v6.9.0
v6.10.0
v6.10.1
v6.11.0
v6.12.0
v6.13.0
v6.13.1
v6.14.0
v6.15.0
v6.15.1
v6.16.0
v6.17.0
v6.17.1
v6.18.0
v6.18.1
v6.18.2
v6.18.3
v6.18.4
v6.18.5
v6.18.6
v6.18.7
v6.18.8
v6.18.9
v6.18.10
v6.18.11
v6.18.12
v6.18.13
v6.18.14
v6.18.15
v6.18.16
v6.18.17
v6.18.18
v6.18.19
v6.18.20
v6.18.21
v6.18.22
v6.18.23
v6.18.24
v6.18.25
v6.18.26
v6.18.27
v6.18.28
v6.18.29
v6.18.30
v6.18.31
v6.18.32
v6.18.33
v6.18.34
v6.18.35
v6.18.36
v6.18.37
v6.18.38
v6.18.39
v6.18.40
v6.18.41
v6.18.42
v6.18.43
v6.19.0
v6.19.1
v6.20.0
v6.20.1
v6.20.2
v6.20.3
v6.20.4
v6.20.5
v6.20.6
v6.20.7
v6.20.8
v6.20.9
v6.20.10
v6.20.11
v6.20.12
v6.20.13
v6.20.14
v6.20.15
v6.20.16
v6.20.17
v6.20.18
v6.20.19
v6.20.20
v6.20.21
v6.20.22
v6.20.23
v6.20.24
v6.20.25
v6.20.26
v6.20.27
v6.20.28
v6.20.29
v6.20.30
v6.20.31
v6.20.32
v6.20.33
v6.20.34
v6.20.35
v6.20.36
v6.20.37
v6.20.38
v6.20.39
v6.20.40
v6.20.41
v6.20.42
v6.20.43
v6.20.44
v6.20.45
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.1.0
v7.1.1
v7.1.2
v7.1.3
v7.2.0
v7.2.1
v7.2.2
v7.3.0
v7.4.0
v7.5.0
v7.5.1
v7.5.2
v7.6.0
v7.6.1
v7.6.2
v7.7.0
v7.7.1
v7.8.0
v7.8.1
v7.9.0
v7.9.1
v7.9.2
v7.10.0
v7.10.1
v7.10.2
v7.10.3
v7.11.0
v7.12.0
v7.13.0
v7.14.0
v7.14.1
v7.15.0
v7.16.0
v7.16.1
v7.17.0
v7.17.1
v7.17.2
v7.18.0
v7.19.0
v7.19.1
v7.20.0
v7.21.0
v7.22.0
v7.22.1
v7.22.2
v7.22.3
v7.22.4
v7.23.0
v7.23.1
v7.23.2
v7.24.0
v7.25.0
v7.26.0
v7.26.1
v7.27.0
v7.28.0
v7.28.1
v7.28.2
v7.28.3
v7.28.4
v7.29.0
v7.29.1
v7.29.2
v7.29.3
v7.30.0
v7.30.1
v7.30.2
v7.30.3
v7.30.4
v7.30.5
v7.30.6
v7.30.7
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.1.0
v8.2.0
v8.3.0
v8.4.0
v8.5.0
v8.6.0
v8.7.0
v8.7.1
v8.8.0
v8.9.0
v8.10.0
v8.11.0
v8.11.1
v8.11.2
v8.12.0
v8.12.1
v8.12.2
v8.12.3
v8.13.0
v8.14.0
v8.15.0
v8.16.0
v8.16.1
v8.17.0
v8.17.1
v8.17.2
v8.18.0
v8.18.1
v8.19.0
v8.20.0
v8.20.1
v8.21.0
v8.22.0
v8.22.1
v8.23.0
v8.23.1
v8.24.0
v8.25.0
v8.26.0
v8.26.1
v8.27.0
v8.28.0
v8.28.1
v8.29.0
v8.30.0
v8.30.1
v8.31.0
v8.32.0
v8.32.1
v8.33.0
v8.33.1
v8.34.0
v8.35.0
v8.35.1
v8.36.0
v8.36.1
v8.36.2
v8.37.0
v8.38.0
v8.39.0
v8.40.0
v8.41.0
v8.42.0
v8.42.1
v8.43.0
v8.44.0
v8.45.0
v8.45.1
v8.46.0
v8.47.0
v8.48.0
v8.48.1
v8.48.2
v8.49.0
v8.49.1
v8.49.2
v8.50.0
v8.51.0
v8.52.0
v8.53.0
v8.53.1
v8.54.0
v8.55.0
v8.56.0
v8.57.0
v8.58.0
v8.59.0
v8.60.0
v8.61.0
v8.62.0
v8.63.0
v8.64.0
v8.65.0
v8.66.0
v8.67.0
v8.68.0
v8.68.1
v8.69.0
v8.70.0
v8.70.1
v8.70.2
v8.71.0
v8.72.0
v8.73.0
v8.73.1
v8.73.2
v8.74.0
v8.75.0
v8.76.0
v8.76.1
v8.76.2
v8.77.0
v8.77.1
v8.78.0
v8.78.1
v8.79.0
v8.80.0
v8.81.0
v8.82.0
v8.83.0
v8.83.1
v8.83.2
v8.83.3
v8.83.4
v8.83.5
v8.83.6
v8.83.7
v8.83.8
v8.83.9
v8.83.10
v8.83.11
v8.83.12
v8.83.13
v8.83.14
v8.83.15
v8.83.16
v8.83.17
v8.83.18
v8.83.19
v8.83.20
v8.83.21
v8.83.22
v8.83.23
v8.83.24
v8.83.25
v8.83.26
v8.83.27
v8.83.28
v8.83.29
v9.*
v9.0.0-beta.1
v9.0.0-beta.2
v9.0.0-beta.3
v9.0.0-beta.4
v9.0.0-beta.5
v9.0.0
v9.0.1
v9.0.2
v9.1.0
v9.2.0
v9.3.0
v9.3.1
v9.4.0
v9.4.1
v9.5.0
v9.5.1
v9.6.0
v9.7.0
v9.8.0
v9.8.1
v9.9.0
v9.10.0
v9.10.1
v9.11.0
v9.12.0
v9.12.1
v9.12.2
v9.13.0
v9.14.0
v9.14.1
v9.15.0
v9.16.0
v9.17.0
v9.18.0
v9.19.0
v9.20.0
v9.21.0
v9.21.1
v9.21.2
v9.21.3
v9.21.4
v9.21.5
v9.21.6
v9.22.0
v9.22.1
v9.23.0
v9.24.0
v9.25.0
v9.25.1
v9.26.0
v9.26.1
v9.27.0
v9.28.0
v9.29.0
v9.30.0
v9.30.1
v9.31.0
v9.32.0
v9.33.0
v9.34.0
v9.35.0
v9.35.1
v9.36.0
v9.36.1
v9.36.2
v9.36.3
v9.36.4
v9.37.0
v9.38.0
v9.39.0
v9.40.0
v9.40.1
v9.41.0
v9.42.0
v9.42.1
v9.42.2
v9.43.0
v9.44.0
v9.45.0
v9.45.1
v9.46.0
v9.47.0
v9.48.0
v9.49.0
v9.50.0
v9.50.1
v9.50.2
v9.51.0
v9.52.0
v9.52.1
v9.52.2
v9.52.3
v9.52.4
v9.52.5
v9.52.6
v9.52.7
v9.52.8
v9.52.9
v9.52.10
v9.52.11
v9.52.12
v9.52.13
v9.52.14
v9.52.15
v9.52.16
v9.52.17
v9.52.18
v9.52.19
v9.52.20
v9.52.21
v9.52.22
v10.*
v10.0.0
v10.0.1
v10.0.2
v10.0.3
v10.1.0
v10.1.1
v10.1.2
v10.1.3
v10.1.4
v10.1.5
v10.2.0
v10.3.0
v10.3.1
v10.3.2
v10.3.3
v10.4.0
v10.4.1
v10.5.0
v10.5.1
v10.6.0
v10.6.1
v10.6.2
v10.7.0
v10.7.1
v10.8.0
v10.9.0
v10.10.0
v10.10.1
v10.11.0
v10.12.0
v10.13.0
v10.13.1
v10.13.2
v10.13.3
v10.13.5
v10.14.0
v10.14.1
v10.15.0
v10.16.0
v10.16.1
v10.17.0
v10.17.1
v10.18.0
v10.19.0
v10.20.0
v10.21.0
v10.21.1
v10.22.0
v10.23.0
v10.23.1
v10.24.0
v10.25.0
v10.25.1
v10.25.2
v10.26.0
v10.26.1
v10.26.2
v10.27.0
v10.28.0
v10.29.0
v10.30.0
v10.30.1
v10.31.0
v10.32.0
v10.32.1
v10.33.0
v10.34.0
v10.34.1
v10.34.2
v10.35.0
v10.36.0
v10.37.0
v10.37.1
v10.37.2
v10.37.3
v10.38.0
v10.38.1
v10.38.2
v10.39.0
v10.40.0
v10.41.0
v10.42.0
v10.43.0
v10.44.0
v10.45.0
v10.45.1
v10.46.0
v10.47.0
v10.48.0
v10.48.1
v10.48.2
v10.48.3
v10.48.4
v10.48.5
v10.48.6
v10.48.7
v10.48.8
v10.48.9
v10.48.10
v10.48.11
v10.48.12
v10.48.13
v10.48.14
v10.48.15
v10.48.16
v10.48.17
v10.48.18
v10.48.19
v10.48.20
v10.48.21
v10.48.22
v10.48.23
v10.48.24
v10.48.25
v10.48.26
v10.48.27
v10.48.28
v10.48.29
v10.49.0
v10.49.1
v10.50.0
v10.50.1
v10.50.3
10.*
10.50.2
v11.*
v11.0.0
v11.0.1
v11.0.2
v11.0.3
v11.0.4
v11.0.5
v11.0.6
v11.0.7
v11.0.8
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.4.0
v11.5.0
v11.6.0
v11.7.0
v11.8.0
v11.9.0
v11.9.1
v11.9.2
v11.10.0
v11.11.0
v11.11.1
v11.12.0
v11.13.0
v11.14.0
v11.15.0
v11.16.0
v11.17.0
v11.18.0
v11.18.1
v11.19.0
v11.20.0
v11.21.0
v11.22.0
v11.23.0
v11.23.1
v11.23.2
v11.23.3
v11.23.4
v11.23.5
v11.24.0
v11.24.1
v11.25.0
v11.26.0
v11.27.0
v11.27.1
v11.27.2
v11.28.0
v11.28.1
v11.29.0
v11.30.0
v11.31.0
v11.32.0
v11.33.0
v11.33.1
v11.33.2
v11.34.0
v11.34.1
v11.34.2
v11.35.0
v11.35.1
v11.36.0
v11.36.1
v11.37.0
v11.38.0
v11.38.1
v11.38.2
v11.39.0
v11.39.1
v11.40.0
v11.41.0
v11.41.1
v11.41.2
v11.41.3
v11.42.0
v11.42.1
v11.43.0
v11.43.1
v11.43.2
v11.44.0
v11.44.1
v11.44.2
v11.44.3
v11.44.4
v11.44.5
v11.44.6
v11.44.7
v11.45.0
v11.45.1
v11.45.2
v11.45.3
v11.46.0
v11.46.1
v11.46.2
v11.47.0
v11.48.0
v11.49.0
v11.50.0
v11.51.0
v11.52.0
v11.53.0
v11.53.1
v11.54.0
v11.55.0
v11.55.1
v11.56.0
v11.56.1
v11.57.0
v12.*
v12.0.0
v12.0.1
v12.1.0
v12.1.1
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.5.0
v12.6.0
v12.7.0
v12.7.1
v12.7.2
v12.8.0
v12.8.1
v12.9.0
v12.9.1
v12.9.2
v12.10.0
v12.10.1
v12.10.2
v12.11.0
v12.11.1
v12.12.0
v12.13.0
v12.14.0
v12.14.1
v12.15.0
v12.16.0
v12.17.0
v12.18.0
v12.19.0
v12.19.1
v12.19.2
v12.19.3
v12.20.0
v12.21.0
v12.22.0
v12.22.1
v12.23.0
v12.23.1
v12.24.0
v12.25.0
v12.26.0
v12.26.1
v12.26.2
v12.26.3
v12.26.4
v12.27.0
v12.27.1
v12.28.0
v12.28.1
v12.29.0
v12.30.0
v12.30.1
v12.31.0
v12.31.1
v12.32.0
v12.32.1
v12.32.2
v12.32.3
v12.32.4
v12.32.5
v12.33.0
v12.34.0
v12.35.0
v12.35.1
v12.36.0
v12.36.1
v12.37.0
v12.38.0
v12.38.1
v12.39.0
v12.40.0
v12.40.1
v12.40.2
v12.41.0
v12.41.1
v12.42.0
v12.43.0
v12.43.1
v12.44.0
v12.45.0
v12.45.1
v12.45.2
v12.46.0
v12.47.0
v12.48.0
v12.48.1
v12.49.0
v12.50.0
v12.51.0
v12.52.0
v12.53.0
v12.54.0
v12.54.1
v12.55.0
v12.55.1
v12.56.0
v12.57.0
v12.58.0
v12.59.0
v12.60.0
v12.60.1
v12.60.2
v12.61.0
v12.61.1
v12.62.0
v12.63.0
v12.64.0
v12.65.0
v12.66.0
v12.67.0