| Severity | CRITICAL |
| Threat Category | Vulnerability – Authentication Bypass (unauthenticated account takeover) |
| Affected Platforms | Laravel Framework before 12.68.0, and 13.0.0 before 13.29.0, when an authentication guard uses the “token” driver with a MySQL or MariaDB database. |
| CVE | CVE-2026-114509 |
| CVSS | 9.2 CRITICAL (v4.0) |
1. Overview
A critical authentication bypass has been fixed in the Laravel Framework, one of the most widely used PHP web application frameworks. CVE-2026-114509 affects Laravel’s built-in TokenGuard when it is configured as a token-based API guard. On applications backed by a MySQL or MariaDB database, an unauthenticated attacker can send a crafted request with a non-string credential that the authentication lookup fails to reject, causing the query to match an existing user. The result is account takeover, including administrator accounts, on any route protected by the affected guard.
The issue is rated 9.2 (Critical) on CVSS version 4.0, with a network attack vector, low attack complexity, and no privileges or user interaction required. It is tracked under CWE-287 (Improper Authentication) and CWE-1287 (Improper Validation of Specified Type of Input). GitHub, acting as the CVE Numbering Authority, published the record on 21 October 2026, following the Laravel security advisory GHSA-f9x3-7vq9-cph6 on 19 October 2026.
2. Who is Affected
An application is affected only if all of the following are true: it runs an affected Laravel version; one of its authentication guards uses the “token” driver (TokenGuard); and it uses a MySQL or MariaDB database. Laravel is widely used for government and private web applications and APIs in Bhutan, so administrators should check these three conditions for each of their applications.
Important scoping point: This flaw is specific to the legacy “token” guard driver. Applications that authenticate their API requests only through Laravel Sanctum or Laravel Passport do not use TokenGuard and do not meet the vendor’s stated preconditions. Even so, Laravel recommends updating regardless, because the preconditions can be hard to rule out and the same releases also fix a separate moderate-severity issue, CVE-2026-114508 (unauthorized data destruction).
BtCIRT has not received any reports of confirmed exploitation within Bhutan at the time of publication, and the cited sources report no confirmed in-the-wild exploitation and no published proof-of-concept exploit. The severity is nonetheless assessed as CRITICAL for the following reasons:
- Successful exploitation allows a remote, unauthenticated attacker to take over user accounts, including administrators, which is among the most severe outcomes for a web application.
- The attack requires no credentials, no user interaction, and is rated low complexity once the preconditions are met.
- The fixes shipped quietly in routine releases on 25 August 2026 and were not labelled as security fixes at the time. Applications that have not updated since then remain exposed, and the public advisory now draws attacker attention to the flaw.
- Laravel and MySQL or MariaDB are a very common combination, so the potentially affected population is large.
3. How the Vulnerability Works
- Stage 1 – Root Cause
Laravel’s TokenGuard looks up the user associated with an API token supplied in a request. In the affected versions the guard did not verify that the supplied credential was actually a string before using it in the database lookup. The fix adds a type check so that TokenGuard only accepts a non-empty string token and rejects any non-string value without querying the database (CWE-287, Improper Authentication; CWE-1287, Improper Validation of Specified Type of Input).
- Stage 2 – Exploitation
An unauthenticated attacker sends a crafted request to a route protected by the token guard, supplying a non-string value where the API token is expected. On applications using MySQL or MariaDB, the database handling of that value during the authentication lookup causes the query to match an existing user record rather than failing. The attacker is then treated as that user. Because the attack complexity is low, no timing windows or race conditions are involved once the preconditions are met.
- Stage 3 – Impact
The attacker gains authenticated access as the matched user on every route protected by the affected guard. If the matched user is an administrator, this gives full administrative access. From there the attacker can read and modify that user’s data, perform any action the account is permitted, access sensitive records through the API, and use the foothold to attack the wider application and its data.
- Stage 4 – Fix and Disclosure
Laravel corrected the flaw by adding a string-type check to TokenGuard. The fix shipped in releases 12.68.0 and 13.29.0 on 25 August 2026, without being labelled as a security fix in the release notes. The issue was later disclosed publicly in an advisory (GHSA-f9x3-7vq9-cph6) on 19 October 2026, and GitHub assigned CVE-2026-114509 on 21 October 2026. It was reported by an external security researcher (credited as KIKOmanasijev).
4. Indicators to Watch For
- The application runs an affected Laravel version. Check with: composer show laravel/framework. Vulnerable if below 12.68.0, or 13.0.0 up to below 13.29.0.
- An authentication guard uses the token driver. Check with: grep -n “‘driver’ => ‘token'” config/auth.php
- The application uses MySQL or MariaDB. Check the database connection in config/database.php or the .env file.
- Successful API authentication for existing or privileged accounts from unfamiliar IP addresses, where no matching API token was issued to that user.
- Actions on administrator or other privileged accounts performed through the API that the legitimate account owner did not carry out.
- API requests to token-protected routes carrying malformed or unusually structured credential values.
5. Recommendations
5.1. For organizations and government offices:
- Update the Laravel Framework to 12.68.0 or 13.29.0 (or later) with composer update laravel/framework, and raise the version constraint in composer.json so the patched version is retained.
- Confirm your exposure by checking each application for a token-driver guard in config/auth.php and a MySQL or MariaDB database connection. Applications using only Sanctum or Passport are not affected by this issue, but should still be kept up to date.
- There is no official workaround. If updating must be delayed, add middleware that rejects any request whose API credential is not a plain, non-empty string. Treat this as an unofficial interim measure only; it does not replace updating.
- If you run Laravel 11 or earlier, note that no patch is available for your branch. Plan an upgrade to a supported major version as a priority.
- Rotate API tokens for administrator and other privileged accounts if an affected version was in production for any period, in case tokens or accounts were abused.
- Review API authentication logs covering the whole period the affected version ran in production, looking for the indicators in Section 4. If evidence of compromise is found, treat the affected accounts and data as exposed and respond accordingly.
- If your application is maintained by an external developer or runs on managed hosting, confirm with them which Laravel version is deployed and ensure it is updated.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt.
7. Sources and References
- Laravel TokenGuard authentication bypass through non-string API credentials – GHSA-f9x3-7vq9-cph6 (19 October 2026).
https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6 - CVE-2026-114509 – CVE Record (GitHub, Inc.) (21 October 2026). https://www.cve.org/CVERecord?id=CVE-2026-114509
- Laravel Framework release v12.68.0 (25 August 2026). https://github.com/laravel/framework/releases/tag/v12.68.0
- Laravel Framework fix commit 8dbb08b (TokenGuard string-type check) (August 2026). https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- Laravel Security Advisories CVE-2026-114509 and CVE-2026-114508: Token Guard Auth Bypass and Unauthorized Data Destruction (Qadr Labs) (22 October 2026).
https://qadrlabs.com/post/laravel-security-advisories-cve-2026-114509-and-cve-2026-114508-token-guard-auth-bypass-and-unauthorized-data-destruction