Laravel - Authentication Bypass (CVE-2026-114509)
Description
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
psychologyCrowdSec Analysis
CVE-2026-114509 is a critical authentication bypass vulnerability in Laravel’s TokenGuard, affecting versions prior to 12.68.0 and 13.29.0 when used with certain MySQL or MariaDB configurations. An unauthenticated attacker can submit a crafted non-string credential to match an unintended user and take over accounts protected by TokenGuard; upgrading to a fixed version addresses the issue.
CrowdSec has been tracking this vulnerability and its exploits since 4th of November 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-114509 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Observed authentication-bypass attempts target /api/user, /api/me, /api/profile, and /api/v1/user with a JSON request body containing {"api_token":[0]}. The array-valued token can trigger vulnerable Laravel TokenGuard behavior and return user data without authentication.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-10-21 |
| Rule Released | 2026-11-04 |
Related Weaknesses
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Remediation & Protection
External References
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/releases/tag/v13.29.0
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-114509.yaml