CVE-2026-114509
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In Laravel before 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account.
Risk Assessment
An unauthenticated attacker can take over a user account on routes protected by TokenGuard, risking unauthorized application access.
Recommendation
Upgrade Laravel to 12.68.0 or 13.29.0 and review TokenGuard and MySQL/MariaDB configurations.
Other vulnerabilities in Laravel
See all- CVE-2026-114508Medium
In Laravel from 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity.
- CVE-2026-102279Low
In Laravel prior to versions 12.69.0 and 13.30.0, exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML=true, enabling DOM-based cross-site scripting when a user hovers over the tooltip.
- CVE-2026-48019High
Laravel before versions 12.60.0 and 13.10.0 has a CRLF injection vulnerability in email validation, which combined with Symfony Mailer and Symfony Mime handling of certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing. Patched in 12.60.0 and 13.10.0.
Original NVD description (English source)
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS