CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials

TokenGuard reads the API token from the request (the api_token input by default) and passes it to the user provider's retrieveByCredentials lookup. Before the fix, the guard only checked that the value was not empty. It never checked that it was a string. A request such as ?api_token[]=0 delivers an array instead of a token.

The advisory says that under certain database configurations (MySQL and MariaDB) the query built from that value matches an unintended user record instead of failing. The attacker does not need to know a valid token.

In practice, anyone who can reach a route protected by the token guard can authenticate as another existing user. That gives account takeover on every route behind the guard, including API endpoints that expose or change data. The attack needs network access only. It needs no account, no user interaction and no malicious repository. The CVSS vector rates complexity low, with an attack-requirements flag for the database configuration.

Apps that use Sanctum, Passport or session guards instead of the plain token driver are not described as affected.

Affected: laravel/framework 13.0.0 up to but not including 13.29.0, and every release below 12.68.0. The risk applies to apps that configure a guard with the token driver (TokenGuard) and run on MySQL or MariaDB.

Check the installed version:

composer show laravel/framework

Then look in config/auth.php for a guard whose driver is token.

Upgrade to 12.68.0 on the 12.x line or 13.29.0 on the 13.x line:

composer update laravel/framework

The fix, in src/Illuminate/Auth/TokenGuard.php, accepts only string tokens. user() now returns null and validate() returns false for any non-string input. The advisory lists no workarounds, so upgrading is the only remediation it gives.

Search web server and application logs for requests that pass the token as an array or other non-scalar form, for example api_token[]= or api_token[ in the query string, or a JSON body where the token field is an array or object. Look for successful authenticated requests on token-guarded routes that come from clients you do not know. Compare them with the users those requests acted as. The advisory gives no indicators of compromise beyond this, so treat these as heuristics.

Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.

Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

Impact

An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.