CVE-2026-114509 laravel CVE debrief

Who should care

Defenders responsible for systems using Laravel's TokenGuard, especially those with MySQL/MariaDB databases, should assess exposure and apply necessary patches or mitigations to prevent authentication bypass and potential account takeovers.

Why it matters

CVE-2026-114509 is an authentication bypass vulnerability in Laravel's TokenGuard that allows unauthenticated attackers to authenticate as existing users without their API tokens, potentially leading to account takeovers. Defenders should verify exposure, apply patches, and monitor for suspicious activity.

• Potential for unauthenticated attackers to gain unauthorized access
• Risk of account takeover on routes protected by the affected guard
• Need for verification of exposure and application of patches or mitigations
• Importance of monitoring for suspicious authentication attempts

Technical summary

The vulnerability exists in Laravel's TokenGuard when used with a standard token-based API guard and certain database configurations (MySQL/MariaDB). An attacker can bypass authentication by submitting a specially crafted, non-string credential value, allowing them to authenticate as an arbitrary existing user without their API token. This issue can lead to account takeover on routes protected by the affected guard. Defenders should prioritize verifying exposure and applying patches or mitigations, especially for systems using Laravel's TokenGuard with MySQL/MariaDB databases.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, especially for systems using Laravel's TokenGuard with MySQL/MariaDB databases.

Recommended defensive actions

• Verify if the system uses Laravel's TokenGuard with MySQL/MariaDB databases
• Check if the installed version of Laravel is affected
• Apply patches or updates to fixed versions (v12.68.0 or v13.29.0)
• Implement compensating controls like additional authentication checks
• Monitor for suspicious authentication attempts

Evidence notes

The vulnerability details are based on the provided source corpus, which includes information from the CVE Program, NVD, and supplemental sources like GitHub advisories and commit records. The evidence is limited and defenders should verify exposure and apply patches or mitigations to prevent authentication bypass and potential account takeovers. The CVE record was published on 2026-10-23T21:50:27.000Z and has not been modified since then. No additional information is available beyond the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.