Security fix · CVE-2026-114509
Laravel is a web application framework.
Published Oct 21, 2026 · catalog updated Oct 27, 2026 · Laravel Laravel Framework
Last checked Oct 31, 2026. A connected source was read within the last 7 days.
Patch now
CVE-2026-114509 is in the CISA known-exploited catalog. Confirm Laravel Laravel Framework against the vendor advisory and apply that fix. The CVSS score does not change the priority.
Same product and reporting
- CVE-2024-52301 · Unknown · known exploited
- CVE-2017-16894 · Unknown · known exploited
- CVE-2024-29291 · Unknown · known exploited
- CVE-2019-9081 · Unknown · known exploited
- CVE-2018-15133 · High · known exploited
- Severity
- Critical9.2
- Known exploitation
- CISA KEV and VulnCheck KEV
- EPSS
- 0.78%
- Remediation
- Remediation guidance
- Affected products
- Packagist laravel/framework · composer laravel · composer laravel/framework · vendor Laravel Laravel Framework · vendor laravel
Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. **Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. ### Impact An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Packagist laravel/framework0 → 12.68.0
- Packagist laravel/framework13.0.0 → 13.29.0
- composer laravelversion unspecified
- composer laravel/framework< 12.68.0
- composer laravel/framework>= 13.0.0, < 13.29.0
- vendor Laravel Laravel Frameworkversion unspecified
- vendor laravelversion unspecified
How to fix CVE-2026-114509
Vendor action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Version check
Affected < 12.68.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
CVE-2026-114509 is in the CISA known-exploited catalog. Confirm Laravel Laravel Framework against the vendor advisory and apply that fix. The CVSS score does not change the priority.
Which versions are affected?
Compare what you have installed with 0 → 12.68.0, 13.0.0 → 13.29.0, < 12.68.0, >= 13.0.0, < 13.29.0. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
What should an analyst verify?
CWE-1287; CWE-287: Improper Authentication. EPSS 0.78%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 21, 2026 · NIST NVD
Detected
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by
Oct 23, 2026 · GitHub Advisory Database
Fix available
laravel/framework fixed in 13.29.0; laravel/framework fixed in 12.68.0
Oct 23, 2026 · GitHub Advisory Database
Fix available
laravel/framework fixed in 13.29.0
Oct 23, 2026 · GitHub Advisory Database
Fix available
laravel/framework fixed in 12.68.0
Oct 23, 2026 · GitHub Advisory Database
Updated
Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. **Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlyin
Oct 27, 2026 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Oct 27, 2026 · VulnCheck KEV
Updated
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by
Sources
- CVE.orgVulnerability recordCVE-2026-114509
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-114509
30-day exploitation probability 0.78%
first.org - EUVDVulnerability recordEUVD-2026-107583
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended exist
euvd.enisa.europa.eu - GitHub Advisory DatabasePackage advisoryGHSA-f9x3-7vq9-cph6
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-114509
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query
advisories.gitlab.com - NIST NVDVulnerability recordCVE-2026-114509
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended exist
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-f9x3-7vq9-cph6
Laravel TokenGuard authentication bypass through non-string API credentials
osv.dev - urlscan.ioThreat intelligenceCVE-2026-114509urlscan.io
- VulnCheck KEVConfirmed exploitationCVE-2026-114509
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended exist
vulncheck.com
References
Freshness
Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSOct 31, 2026
- urlscan.ioOct 31, 2026
- VulnCheck KEVOct 30, 2026
- GitLab Advisory DatabaseOct 27, 2026
- GitHub Advisory DatabaseOct 26, 2026
- OpenSSF OSV / OSV ScannerOct 26, 2026
- CVE.orgOct 22, 2026
- EUVDOct 22, 2026
- NIST NVDOct 22, 2026