Laravel CVE-2026-114509: Check Your API Token Guard and Update

If your business runs a web app or mobile app backend on Laravel, check one file today. Laravel published a critical advisory, tracked as CVE-2026-114509 (GHSA-f9x3-7vq9-cph6), with a CVSS score of 9.2. It affects the framework's built-in token-based API guard.

What the advisory says

On MySQL and MariaDB, an unauthenticated attacker could authenticate as an existing user without knowing that user's API token. Laravel's own wording is that the guard mishandled a "non-string credential value" during the lookup, so the query matched a user record it should not have. The result is account takeover on any route protected by the affected guard.

Before the fix, the guard only checked that the token was not empty. The fix adds a check that the token is a string before it touches the database.

Are you affected?

You need all of these to be true:

1. Your app uses Laravel below 12.68.0 (or a 13.x release below 13.29.0).
2. A guard in config/auth.php uses 'driver' => 'token'.
3. Your users live in MySQL or MariaDB.

Laravel News notes that Sanctum and Passport register their own guard drivers and are not listed in the advisory. If your API only uses those, this particular flaw is not in scope, but read your own config/auth.php rather than assuming.

SecurityOnline reports that a public proof of concept has appeared, with no confirmed exploitation in the wild at the time of writing. We are not linking it. Patching is the right response either way.

What to do today

1. Find your guards. Search config/auth.php for the token driver.
2. Update the framework. Run composer update laravel/framework and confirm you are on 12.68.0, 13.29.0 or later. Laravel lists no workaround.
3. Run composer audit to compare every installed package with published advisories.
4. Look at your logs. Check token-protected routes for logins that do not match real users, and rotate API tokens if anything looks wrong.
5. Test the API after the update, especially mobile app logins and partner integrations.
6. Plan the upgrade if you are on an older Laravel line with no patch. Laravel News says patches exist only for 12.x and 13.x.

Laravel also published a separate medium-severity advisory on the same day for JSON:API resources, fixed in the same releases. Updating covers both.

Keeping a framework current is the cheapest security work there is. Our website maintenance guide covers a routine for it, and the mobile app security checklist covers the API side. If you would like us to review your Laravel app, get in touch.

Frequently asked questions

Which Laravel versions fix CVE-2026-114509?

12.68.0 and 13.29.0 or later.

Does it affect Sanctum or Passport?

The advisory covers the token driver only.

Sources

• Laravel News: Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68
• SecurityOnline: Laravel Authentication Bypass PoC Released for Critical TokenGuard Flaw
• The Hacker News: ThreatsDay bulletin (22 October 2026)

Last reviewed 23 October 2026. This is general security information, not a guarantee of protection. Check Laravel's advisory page for the latest version details.