Aller au contenu
Se connecter
9.2 Critique

CVE-2026-114509 Laravel is a web application framework

Description

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
framework 13.0 13.0.0 → < 13.29.0 13.29.0
framework 12.68 premières → < 12.68.0 12.68.0

Autres CVE de framework

Les 9 CVE de framework →
CVE-2026-114508 Laravel is a web application framework 6.5 Moyenne CVE-2026-102279 Laravel is a web application framework 3.1 Faible CVE-2026-48019 Laravel is a web application framework 8.9 Élevée CVE-2025-27515 Laravel is a web application framework 6.9 Moyenne
Suivre cette CVE