Laravel TokenGuard Auth Bypass CVE-2026-114509

What to do

1. Run grep -rn "'driver' => 'token'" config/ to see whether any guard uses TokenGuard.
2. Check your version with composer show laravel/framework and upgrade to 12.68.0 or 13.29.0 (11.x: 11.56.1 or later).
3. Run composer audit --locked in CI so GHSA-f9x3-7vq9-cph6 fails the build on any unpatched app.
4. On Laravel 10 or older, add middleware that rejects any non-string api_token input until you can upgrade or move to Sanctum.
5. Plan a move off the legacy token driver to Sanctum or Passport.

How to check if you are affected or compromised

• Search access logs for array-style token parameters, for example grep -E 'api_token(\[|%5B)' on your web server logs.
• Review TokenGuard-protected API activity since August 25 for one account acting from unfamiliar IPs or clients.
• JSON request bodies are not in standard access logs; if you log request bodies at a WAF or gateway, search for "api_token": [ there.

What happened#

On October 19, 2026, Laravel published GHSA-f9x3-7vq9-cph6, rated critical (CVSS 4.0 9.2). The CVE-2026-114509 record followed on October 21. The built-in TokenGuard, the token guard driver, does not reject a non-string credential. On MySQL or MariaDB, that lets an unauthenticated attacker be logged in as an existing user on any route the guard protects. Hristijan Manasijev reported it.

The fix shipped well before the advisory. Commit 8dbb08b, titled only "fix token retrieval", adds an is_string() check to user() and validate(). It was released in v12.68.0 and v13.29.0 on August 25. Teams that follow normal minor updates are probably already patched.

The mechanism is ordinary type juggling, and the commit's own test shows the payload: api_token=[0]. A one-element array is not empty(), so the guard passes it to the user provider. The provider turns array values into whereIn(), producing roughly where api_token in (0). MySQL compares a string column to the integer 0 by converting each token to a number, and a token that does not start with a digit converts to 0. The first matching row is authenticated. The query has no ordering, so the attacker gets an arbitrary user rather than a chosen one (lilting.ch analysis).

Who is affected#

• Apps with a guard set to 'driver' => 'token' in config/auth.php. Laravel 7 and earlier shipped this as the default api guard, and upgraded projects often still carry it.
• A MySQL or MariaDB database. The advisory names no other databases.
• laravel/framework below 12.68.0, or 13.x below 13.29.0. The 11.x branch has the same fix in tag v11.56.1, although the advisory does not list it. The 10.x branch has no fix.
• Not affected: Sanctum, Passport and session guards, which register their own drivers (Laravel News). Note that Passport had an unrelated bypass, CVE-2026-39976. Do not confuse the two.

Do you really need to act?#

Only if you match all the preconditions, and then yes. Most current Laravel apps authenticate APIs with Sanctum and never touch TokenGuard. For apps that do, the attack needs no credentials, works with one HTTP request, and yields a real user session. The CVSS "attack requirements: present" flag most likely reflects the database condition, not a race the attacker must win. One analysis reads the code as safe when the guard's hash option is true, because hashing an array throws a type error first. The advisory does not draw that line, so upgrade either way.

No exploitation has been reported as of October 24, 2026, and the CVE is not in CISA KEV. Still, the patch diff has been public since August, and the test case spells out the input. Expect scanners to add it.

What to do now#

1. Find exposure: grep -rn "'driver' => 'token'" config/. No match means this CVE does not affect you.
2. Check and upgrade: composer show laravel/framework, then composer update laravel/framework to 12.68.0, 13.29.0, or 11.56.1 or later.
3. Run composer audit --locked in CI so this and later advisories fail the build.
4. Stuck on Laravel 10 or older? Add middleware that returns 401 when api_token input is not a string, and schedule the upgrade.
5. Move off the token driver to Sanctum or Passport. Old skeletons configured it with 'hash' => false, which stores tokens in plaintext.

How to tell if you were hit#

Query-string attempts show up in access logs: grep -E 'api_token(\[|%5B)' /var/log/nginx/access.log*. JSON bodies such as {"api_token":[0]} do not appear in standard logs. Search gateway or WAF body logs if you keep them. In application data, look for one account suddenly making API calls from unfamiliar IPs or clients, especially an account whose token begins with a letter.

Timeline#

• Aug 25, 2026 — Laravel 12.68.0, 13.29.0 and 11.56.1 released with the is_string() fix. No advisory yet.
• Oct 19, 2026 — GHSA-f9x3-7vq9-cph6 published.
• Oct 21, 2026 — CVE-2026-114509 published.
• Oct 24, 2026 — No known exploitation. Not in CISA KEV.

Vulnerability records

• CVE-2026-114509 · Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Laravel — GHSA-f9x3-7vq9-cph6: Token-based API guard auth bypass github.com
2. CVE record — CVE-2026-114509 cve.org
3. laravel/framework — commit 8dbb08b: fix token retrieval github.com
4. laravel/framework — Release v12.68.0 github.com
5. laravel/framework — Release v13.29.0 github.com
6. Laravel News — Critical token guard auth bypass in Laravel laravel-news.com
7. lilting.ch — Laravel TokenGuard auth bypass analysis lilting.ch