CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

CVE-2026-114509

The Laravel web application framework is vulnerable to an authentication bypass in versions prior to 12.68.0 and 13.29.0 . When TokenGuard is configured as a standard token-based API guard, it fails to reject crafted non-string credentials . In specific MySQL or MariaDB configurations, this flaw ...