{"id":"ghsa-ghsa-f9x3-7vq9-cph6","seq":661310,"kind":"advisory","title":"Laravel TokenGuard authentication bypass through non-string API credentials","url":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f9x3-7vq9-cph6","summary":"影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0\nLaravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…","severity":"critical","techs":["php","laravel"],"cves":["CVE-2026-114509"],"tags":["GHSA-f9x3-7vq9-cph6","laravel/framework","laravel/framework"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:50:27.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}