Laravel TokenGuard Auth Bypass Lets Attackers Impersonate Users Without Valid API Tokens (CVE-2026-114509)

A new GitHub Security Advisory (GHSA-f9x3-7vq9-cph6, CVE-2026-114509) discloses an authentication bypass in Laravel's built-in TokenGuard, the standard token-based API guard shipped with the laravel/framework package.

What was reported

According to the advisory, when TokenGuard is configured for standard token-based API authentication, and under certain database configurations (MySQL/MariaDB are specifically named), an attacker can submit a specially crafted, non-string credential value. This value is reportedly mishandled during the authentication lookup, causing the underlying query to match an unintended existing user record instead of failing the lookup as expected. The practical effect is that an unauthenticated attacker may authenticate as an arbitrary existing user without ever possessing that user's real API token. The advisory status is public PoC, with no CVSS score currently listed in the feed.

Why it matters

Any route or API protected by a TokenGuard-based auth:api (or similarly configured token guard) is potentially exposed to account takeover — not of a specific targeted account, but of whichever user record the malformed query happens to match. Given how widely Laravel's API token guard is used for first-party and internal APIs, the blast radius is largely a function of how many deployed applications rely on this guard and which database backend they run.

What defenders should do now

• Treat this as urgent patch triage: identify any Laravel applications using TokenGuard/token-based API auth, confirm the laravel/framework version against the fixed release referenced in the advisory, and patch or upgrade promptly.
• If immediate patching isn't possible, review the database driver in use — the advisory specifically calls out MySQL/MariaDB configurations as affected — and consider temporary compensating controls (e.g., additional authorization checks that don't rely solely on the token guard's user resolution).
• Hunt for anomalies in API auth logs: unexpected non-string or malformed values in fields normally expected to be opaque token strings (e.g., arrays, booleans, or object-like payloads) submitted to token-protected endpoints.
• Review for signs of unexplained cross-account access — requests authenticated as a given user ID that don't correlate with that user's known token or session history.
• Since this is PoC-public, prioritize exposed, internet-facing APIs using TokenGuard over internal-only deployments.

This is developing, net-new intelligence from a vendor security advisory published within the last day; details on the precise malformed-input mechanics and affected version ranges may be refined as the advisory matures. For authoritative details and the fix, see the original GitHub Security Advisory: GHSA-f9x3-7vq9-cph6.