Laravel TokenGuard: Log In as Any User Without Their API Token

Published as "Laravel TokenGuard authentication bypass through non-string API credentials"

critical Laravel Laravel framework · Last reviewed Oct 31, 2026

CVE: CVE-2026-114509
GHSA: GHSA-f9x3-7vq9-cph6
Packagist: PKSA-b41t-wbzk-9q51
Reported: Oct 23, 2026

Lets an unauthenticated attacker log in as another user in Laravel apps that use the token auth guard with MySQL or MariaDB.

Affected and fixed versions

In laravel/framework. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
13.0.0 – 13.28.x	13.29.0	Supported
Up to 12.67.x	12.68.0	Supported

Upgrade

Run the line for the branch you are on.

composer require laravel/framework:^13.29.0
composer require laravel/framework:^12.68.0

What this means

An unauthenticated attacker can log in as another existing user without knowing that user's API token. That gives them the account on every route protected by the affected guard.

Who is affected

Your app is exposed if it authenticates requests with Laravel's built-in TokenGuard, the token driver in config/auth.php, and runs on MySQL or MariaDB. The Laravel advisory says the bypass works under certain configurations of those two databases.

The guard accepted a token that wasn't a plain string. On those databases, the user lookup could then match the wrong user instead of failing. The fix only changes TokenGuard, so apps that don't use the token guard don't run the affected code.

What to do

Update laravel/framework to 13.29.0 if you're on 13.x, or to 12.68.0 if you're on 12.x. Releases older than 12.x are affected and get no fix, so move to one of those two versions.

Reported by KIKOmanasijev.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: Laravel TokenGuard: Log In as Any User Without Their API Token (CVE-2026-114509, GHSA-f9x3-7vq9-cph6)
Details: https://phpnews.net/security/laravel/ghsa-f9x3-7vq9-cph6

Affected versions, as Composer constraints:
- laravel/framework: <12.68.0|>=13.0.0,<13.29.0

Fixed releases on branches that still get security fixes:
- 13.0.0 – 13.28.x: update to 13.29.0
- Up to 12.67.x: update to 12.68.0

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/laravel/ghsa-f9x3-7vq9-cph6 and check whether the project meets the conditions it describes (a feature in use, a config value, a driver). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

← All Laravel advisories