---
title: "Laravel TokenGuard Auth Bypass CVE-2026-114509"
url: https://erroneo.us/security/briefs/laravel-tokenguard-auth-bypass-cve-2026-114509/
description: "Non-string api_token lets attackers log in as a user on Laravel token-driver guards over MySQL/MariaDB. Fixed in 12.68.0/13.29.0. Check your auth.php."
type: security-brief
section: "Security Digest"
date_published: 2026-10-19
date_modified: 2026-10-24
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-114509"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Laravel TokenGuard Auth Bypass CVE-2026-114509

**Verdict: Check exposure.** Only apps that still use Laravel's legacy 'token' guard driver on MySQL or MariaDB are at risk, but for them it is an unauthenticated account takeover with a one-line payload; grep auth.php and upgrade.

- **Who must act:** Laravel apps with a guard using 'driver' => 'token' in config/auth.php (typically older projects whose 'api' guard came from a Laravel 7-era skeleton) backed by MySQL or MariaDB.
- **Who can relax:** Apps that authenticate APIs only with Sanctum, Passport or session guards, apps on PostgreSQL, SQLite or SQL Server, and anyone already on laravel/framework 12.68.0, 13.29.0 or 11.56.1 or later.
- **Affected:** laravel/framework 13.x before 13.29.0; laravel/framework before 12.68.0; laravel/framework 10.x and older (no fixed release)
- **Fixed:** laravel/framework 13.29.0; laravel/framework 12.68.0; laravel/framework 11.56.1 (fix present in tag; not listed in the advisory)
- **CVEs:** CVE-2026-114509
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Run grep -rn "'driver' => 'token'" config/ to see whether any guard uses TokenGuard.
2. Check your version with composer show laravel/framework and upgrade to 12.68.0 or 13.29.0 (11.x: 11.56.1 or later).
3. Run composer audit --locked in CI so GHSA-f9x3-7vq9-cph6 fails the build on any unpatched app.
4. On Laravel 10 or older, add middleware that rejects any non-string api_token input until you can upgrade or move to Sanctum.
5. Plan a move off the legacy token driver to Sanctum or Passport.

### How to check if you are affected

- Search access logs for array-style token parameters, for example grep -E 'api_token(\[|%5B)' on your web server logs.
- Review TokenGuard-protected API activity since August 25 for one account acting from unfamiliar IPs or clients.
- JSON request bodies are not in standard access logs; if you log request bodies at a WAF or gateway, search for "api_token": [ there.

## What happened

On October 19, 2026, Laravel published [GHSA-f9x3-7vq9-cph6](https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6), rated critical (CVSS 4.0 9.2). The [CVE-2026-114509](https://www.cve.org/CVERecord?id=CVE-2026-114509) record followed on October 21. The built-in `TokenGuard`, the `token` guard driver, does not reject a non-string credential. On MySQL or MariaDB, that lets an unauthenticated attacker be logged in as an existing user on any route the guard protects. Hristijan Manasijev reported it.

The fix shipped well before the advisory. Commit [8dbb08b](https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5), titled only "fix token retrieval", adds an `is_string()` check to `user()` and `validate()`. It was released in [v12.68.0](https://github.com/laravel/framework/releases/tag/v12.68.0) and [v13.29.0](https://github.com/laravel/framework/releases/tag/v13.29.0) on August 25. Teams that follow normal minor updates are probably already patched.

The mechanism is ordinary type juggling, and the commit's own test shows the payload: `api_token=[0]`. A one-element array is not `empty()`, so the guard passes it to the user provider. The provider turns array values into `whereIn()`, producing roughly `where api_token in (0)`. MySQL compares a string column to the integer 0 by converting each token to a number, and a token that does not start with a digit converts to 0. The first matching row is authenticated. The query has no ordering, so the attacker gets an arbitrary user rather than a chosen one ([lilting.ch analysis](https://lilting.ch/en/articles/laravel-tokenguard-auth-bypass)).

## Who is affected

- Apps with a guard set to `'driver' => 'token'` in `config/auth.php`. Laravel 7 and earlier shipped this as the default `api` guard, and upgraded projects often still carry it.
- A MySQL or MariaDB database. The advisory names no other databases.
- `laravel/framework` below 12.68.0, or 13.x below 13.29.0. The 11.x branch has the same fix in tag v11.56.1, although the advisory does not list it. The 10.x branch has no fix.
- **Not affected:** Sanctum, Passport and session guards, which register their own drivers ([Laravel News](https://laravel-news.com/laravel-token-guard-auth-bypass)). Note that Passport had an unrelated bypass, CVE-2026-39976. Do not confuse the two.

## Do you really need to act?

**Only if you match all the preconditions, and then yes.** Most current Laravel apps authenticate APIs with Sanctum and never touch `TokenGuard`. For apps that do, the attack needs no credentials, works with one HTTP request, and yields a real user session. The CVSS "attack requirements: present" flag most likely reflects the database condition, not a race the attacker must win. One analysis reads the code as safe when the guard's `hash` option is true, because hashing an array throws a type error first. The advisory does not draw that line, so upgrade either way.

No exploitation has been reported as of October 24, 2026, and the CVE is not in CISA KEV. Still, the patch diff has been public since August, and the test case spells out the input. Expect scanners to add it.

## What to do now

1. Find exposure: `grep -rn "'driver' => 'token'" config/`. No match means this CVE does not affect you.
2. Check and upgrade: `composer show laravel/framework`, then `composer update laravel/framework` to 12.68.0, 13.29.0, or 11.56.1 or later.
3. Run `composer audit --locked` in CI so this and later advisories fail the build.
4. Stuck on Laravel 10 or older? Add middleware that returns 401 when `api_token` input is not a string, and schedule the upgrade.
5. Move off the `token` driver to Sanctum or Passport. Old skeletons configured it with `'hash' => false`, which stores tokens in plaintext.

## How to tell if you were hit

Query-string attempts show up in access logs: `grep -E 'api_token(\[|%5B)' /var/log/nginx/access.log*`. JSON bodies such as `{"api_token":[0]}` do not appear in standard logs. Search gateway or WAF body logs if you keep them. In application data, look for one account suddenly making API calls from unfamiliar IPs or clients, especially an account whose token begins with a letter.

## Timeline

- Aug 25, 2026 — Laravel 12.68.0, 13.29.0 and 11.56.1 released with the `is_string()` fix. No advisory yet.
- Oct 19, 2026 — GHSA-f9x3-7vq9-cph6 published.
- Oct 21, 2026 — CVE-2026-114509 published.
- Oct 24, 2026 — No known exploitation. Not in CISA KEV.

## Sources

1. [Laravel — GHSA-f9x3-7vq9-cph6: Token-based API guard auth bypass](https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6)
2. [CVE record — CVE-2026-114509](https://www.cve.org/CVERecord?id=CVE-2026-114509)
3. [laravel/framework — commit 8dbb08b: fix token retrieval](https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5)
4. [laravel/framework — Release v12.68.0](https://github.com/laravel/framework/releases/tag/v12.68.0)
5. [laravel/framework — Release v13.29.0](https://github.com/laravel/framework/releases/tag/v13.29.0)
6. [Laravel News — Critical token guard auth bypass in Laravel](https://laravel-news.com/laravel-token-guard-auth-bypass)
7. [lilting.ch — Laravel TokenGuard auth bypass analysis](https://lilting.ch/en/articles/laravel-tokenguard-auth-bypass)

---
Source page: https://erroneo.us/security/briefs/laravel-tokenguard-auth-bypass-cve-2026-114509/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt