Patching CVE-2026-114509: Laravel TokenGuard API Authentication Bypass

A critical authentication bypass vulnerability, identified as CVE-2026-114509 (GHSA-f9x3-7vq9-cph6), impacts Laravel applications running on versions earlier than 12.68.0 and 13.29.0. When a route is secured using Laravel's standard token-based API guard, known as TokenGuard, it does not accurately validate incoming credentials as strictly strings before forwarding them to the database query builder.

In common MySQL and MariaDB setups, an unauthenticated attacker can submit a specially crafted non-string payload, enabling them to circumvent token verification and gain unauthorized access to an existing user account. This vulnerability falls under the category of CWE-1287 (Improper Type Validation) and CWE-287 (Improper Authentication).

The affected versions include laravel/framework versions 12.68.0 and 13.0.0, as well as 13.29.0. The vulnerable component is Illuminate\Auth\TokenGuard, which is configured to use the token driver in the config/auth.php file.

When the application is set up with TokenGuard in the config/auth.php file, Laravel attempts to extract the token from various sources, such as the request query string, request body, or Bearer authorization header. If an attacker provides a JSON body or query parameter where the api_token is structured as an array or non-string primitive instead of a flat string, Laravel's TokenGuard may pass the non-string input directly into UserProvider::retrieveByCredentials().

This can lead to implicit type conversion or array-to-parameter binding quirks in MySQL or MariaDB, which subsequently evaluates the condition loosely and returns the first matching user record in the table.

To mitigate this threat, it is recommended to audit your application for exposure by running Composer's security audit in your project root, checking your current framework version, and inspecting config/auth.php to identify any guards using driver = "token". If your application relies on Laravel Sanctum (driver = "sanctum") or Laravel Passport (driver = "passport"), the issue does not directly affect your routes, but you should still update the laravel/framework dependency to ensure a clean dependency tree.