## Laravel TokenGuard authentication bypass through non-string API credentials

- 種別: advisory
- 重大度: critical
- 関連技術: php, laravel
- CVE: CVE-2026-114509
- 公開日時: 2026-10-23T21:50:27.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-f9x3-7vq9-cph6)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-f9x3-7vq9-cph6

影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…