laravel · framework
The Laravel web application framework's TokenGuard, when configured as a standard token-based API guard, fails to reject crafted non-string credentials, a flaw in its authentication handling. An unauthenticated remote attacker can exploit this, without any user interaction, when the application uses a MySQL or MariaDB configuration in which the authentication lookup can match an unintended existing user, gaining access to that account on routes protected by TokenGuard.
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
First seen exploited 6 days after disclosure. Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.
5 fixes in laravel/framework over 20 months. The latest fix listed for laravel/framework is 13.30.0.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: laravel/framework.
Upgrade to 13.29.0 or later
Set the version to 13.29.0 or later in your composer.json.
The first fix for CVE-2026-114509.
| If you run | Upgrade to |
|---|---|
| 13.0.0 up to 13.29.0 | 13.29.0 |
| All versions before 12.68.0 | 12.68.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.