Authentication Bypass in Laravel Framework

Laravel

What happened

A vulnerability in Laravel's TokenGuard allows unauthorized access under certain configurations, potentially enabling attackers to take over accounts. This affects the authentication process for protected routes.

Are you affected?

Laravel Framework versions prior to 12.68.0 and between 13.0.0 and 13.29.0.

What to do now

1. Upgrade to Laravel Framework version 12.68.0 or 13.29.0 to resolve the issue.
2. Review your authentication configurations for potential exposure.
3. Monitor application logs for any unauthorized access attempts.

Sources

• cve.now/CVE-2026-114509
• cve.now/GHSA-F9X3-7VQ9-CPH6
• CVE-2026-114509
• GHSA-F9X3-7VQ9-CPH6
• https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
• https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
• https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
• https://github.com/laravel/framework/releases/tag/v12.68.0
• https://github.com/laravel/framework/releases/tag/v13.29.0
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-114509.yaml
• https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard
• https://github.com/Nguemoue/project2026_20261030_tokengate
• https://github.com/Nxploited/CVE-2026-114509
• https://github.com/dimasma0305/CVE-2026-114509
• https://github.com/hakaioffsec/CVE-2026-114509-PoC
• https://github.com/nextmend/laravel-type-juggling-auth-bypass
• https://github.com/tajulasri/-CVE-2026-114509-POC
• https://github.com/mehmet-emir-eroglu/CVE-2026-114509

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.