CVE-2026-114509

CVE-2026-114509 is an authentication bypass vulnerability in the built-in TokenGuard of the Laravel framework, which is used for token-based API authentication. The issue arises because the guard fails to properly validate that incoming API credentials are strings, only checking if they are non-empty. Consequently, an unauthenticated attacker can submit a crafted, non-string credential—such as an array within a JSON request—which bypasses the initial validation checks. When these non-string credentials are sent to a database running certain MySQL or MariaDB configurations, the database engine performs a type-coerced comparison, treating the stored text tokens as numbers. This type confusion causes the authentication lookup query to match an unintended existing user record rather than failing. As a result, attackers can gain unauthorized access and take over accounts on any routes protected by the affected guard. The vulnerability affects Laravel framework versions prior to 12.68.0 and 13.29.0, and has been resolved in those respective releases.