Laravel TokenGuard authentication bypass through non-string API credentials

Critical · fetched 2026-10-23

Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. **Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

Remediation

Upgrade laravel/framework to 13.29.0 or later. Upgrade laravel/framework to 12.68.0 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-23T18:20:12-04:00 · https://github.com/advisories/GHSA-f9x3-7vq9-cph6

← All threats