Can One JSON Array Log You In as Someone Else on Laravel?

A single array where Laravel expected a string can sign an attacker in as one of your real users. Laravel's built-in TokenGuard has a critical authentication bypass, CVE-2026-114509, and public proof-of-concept exploits appeared within a day of the advisory.

Here's what you need to know:

• The bug sits in Laravel's built-in TokenGuard, the classic 'driver' => 'token' API guard. It scores 9.2 (critical) on CVSS 4.0.

• On MySQL or MariaDB, a crafted non-string api_token can match an existing user, giving an unauthenticated attacker account takeover.

• Fixed in laravel/framework 12.68.0 and 13.29.0. The code fix landed in August, but the advisory only went public on October 19.

• Public PoC code is out, and Italy's national CSIRT has warned about it.

• Sanctum and Passport guards aren't named in the advisory, but you should check your own guard config instead of assuming.

How one array token walks past TokenGuard before the fix.

What Happened

Laravel published security advisory GHSA-f9x3-7vq9-cph6 on October 19. It says the built-in TokenGuard, "when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token."

The NVD entry for CVE-2026-114509 explains the trigger: TokenGuard "does not reject a crafted non-string credential," and under affected MySQL or MariaDB setups the lookup "can match an unintended existing user." The CVE record lists versions below 12.68.0, and 13.0.0 up to 13.29.0, as affected.

Brandefense's breakdown of the bug traces one request through the guard. TokenGuard reads the token from the query string, request input, bearer token or basic-auth password, and before the fix it only checked that the value wasn't empty. An array like [0] isn't empty, so it passed. The Eloquent user provider then turned the array into a whereIn query, and MySQL compares text with a number numerically, so the lookup can land on a real account.

The fix is tiny. Two commits titled "fix token retrieval," dated August 25, add an is_string() check in two places in TokenGuard.php. Brandefense notes that the 12.68.0 and 13.29.0 release pages never mention authentication, which is why many teams may have missed the update for almost two months.

Why It Matters

This isn't theoretical anymore. Brandefense found three public GitHub repositories about the flaw by October 24, the first created about 12 hours after the advisory. Security firm Hakai Security said on X that it had reproduced the bug and published a working exploit, and Italy's CSIRT followed on October 22 with an alert that a proof of concept is available.

CISA hadn't added the flaw to its Known Exploited Vulnerabilities catalog as of its October 23 update, according to Brandefense. That's a "patch before it gets worse" signal, not an all-clear.

The exposure is mostly older code. Laravel's skeleton shipped an api guard using the token driver until 2021, so apps that started on Laravel 8 or earlier, or teams that added a token guard later, may still carry it. And it lands in an already rough week for PHP: we covered PHP2Shell, the critical PHP RCE flaws you need to patch now, which is a separate problem in PHP itself.

What It Means for Developers

If you run Laravel APIs, this takes about ten minutes to check:

• Check your version. Run composer show laravel/framework. You need 12.68.0+ on 12.x or 13.29.0+ on 13.x; newer releases are fine.

• Look for the guard. Open config/auth.php and search guards for 'driver' => 'token'. No token guard means this bug doesn't reach you.

• Find the routes. Run php artisan route:list -v and look for auth:api or whatever your token guard is named.

• Mind old branches. Laravel's support policy ended security fixes for Laravel 11 on March 12, 2026 and for Laravel 10 in February 2025. The advisory names no fix for either. A Zenn write-up found the same check in the 11.56.1 tag, but that isn't official.

• Can't upgrade today? Remove the unused token guard, or add a type check of your own so non-string tokens are rejected before any database lookup. Don't rely on 'hash' => true alone, Zenn notes, because validate() doesn't use it.

• Hunt in logs. Look for requests where api_token arrived as a list, back to August 25, and review API sign-ins for accounts used in ways their owners didn't.

Four checks tell you whether CVE-2026-114509 reaches your app.

Dependency hygiene helps here too. Composer 2.11's new cooldown against PHP supply chain attacks protects you from poisoned releases, but only composer update gets you this fix.

What's Next

Watch the CISA KEV catalog and your WAF logs. With working exploits public, it's a matter of when scanners start sending array tokens at auth:api routes, not if.

Open questions remain. The advisory doesn't spell out which MySQL or MariaDB configurations are affected, and Laravel hasn't explained why the advisory came nearly two months after the fix shipped. Brandefense also points to a second advisory, CVE-2026-114508, published seconds later and fixed in 12.68.0 too.

FAQ

Does CVE-2026-114509 affect Laravel Sanctum or Passport?

The advisory only names the framework's built-in TokenGuard and doesn't mention Sanctum or Passport. Check config/auth.php for any guard using the token driver to be sure.

Is my app safe if I use PostgreSQL or SQLite?

The advisory limits the account-match behaviour to certain MySQL and MariaDB configurations. Updating is still the safe move, since the type check is the real fix.

Which Laravel version fixes the TokenGuard bypass?

laravel/framework 12.68.0 on the 12.x line and 13.29.0 on the 13.x line, or anything newer.

Sources

• GHSA-f9x3-7vq9-cph6: Token-based API guard Auth Bypass, Laravel on GitHub

• CVE-2026-114509, NVD

• CVE Record: CVE-2026-114509, CVE Program

• Laravel Authentication Bypass: Check Your App, Brandefense

• Laravel TokenGuard auth bypass workarounds, Zenn

• Laravel release notes and support policy, Laravel documentation

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane. Learn • Build • Share Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.