Laravel TokenGuard authentication bypass through non-string API credentials

影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…

在 GitHub Advisory Database 阅读

2026/10/24 06:50，GitHub Advisory Database 发布了“Laravel TokenGuard authentication bypass through non-string API credentials”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：PHP、Laravel。CVE：CVE-2026-114509。