Skip to content
Sign in
9.2 Critical

CVE-2026-114509 Laravel is a web application framework

Description

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Affected products and versions

Product Affected versions Fixed in
framework 13.0 13.0.0 → < 13.29.0 13.29.0
framework 12.68 earliest → < 12.68.0 12.68.0

Other CVEs of framework

The 9 CVEs of framework →
CVE-2026-114508 Laravel is a web application framework 6.5 Medium CVE-2026-102279 Laravel is a web application framework 3.1 Low CVE-2026-48019 Laravel is a web application framework 8.9 High CVE-2025-27515 Laravel is a web application framework 6.9 Medium
Track this CVE