CVE-2026-114509 — Vulnerability intelligence
PHP / Composer — laravel/framework, laravel/framework
Published:
- CVSS
- 0
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.
### Impact
An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.