Laravel CVE-2026-114509 TokenGuard bypass: what to update

As of October 24, 2026, 08:08 JST (October 23, 23:08 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9). This page covers Laravel's advisory GHSA-f9x3-7vq9-cph6 (CVE-2026-114509) and the one Laravel published beside it, GHSA-5wcm-3v2w-8362 (CVE-2026-114508).

laravel/framework 12.68.0 and 13.29.0, released on August 25, 2026, fix CVE-2026-114509, a critical bug that lets an unauthenticated request act as another user on any route protected by Laravel's built-in token API guard, on some MySQL and MariaDB setups. Update to them or later, and deploy.

The releases came out almost two months before Laravel published the advisory on October 19, so an app updated since August 25 already has the fix. Laravel names no fix for 11.x or older, which the advisory's range covers, and Laravel 11's security support ended on March 12, 2026, so move those apps to 12 or 13.

The advisory describes three conditions: a guard in config/auth.php with 'driver' => 'token', a route that uses it, and a MySQL or MariaDB database "under certain database configurations". Laravel's application skeleton shipped such a guard, named api, from Laravel 5.2 until August 2021, so an app started before then may still have one. The advisory lists one package, laravel/framework, and doesn't mention Sanctum or Passport, which register guards of their own. As checked at 08:08 JST, CISA's Known Exploited Vulnerabilities catalog doesn't list the CVE, Laravel says nothing about attacks, and 2 public GitHub repositories that name the CVE call themselves proofs of concept, the first created on October 20.

Below: the fixed version for each Laravel line, a four-question check, what Composer did in a test on each line, what to do on 11.x, the second advisory, the timeline, what Forge, Vapor, and Laravel Cloud have said, and what is known about exploitation.

Which Laravel versions are fixed

The fixed versions and ranges are the advisory's: affected are "< 12.68.0" and ">= 13.0.0, < 13.29.0" (GitHub Advisory Database, checked 08:08 JST). The first range has no lower bound, so it takes in 11.x, 10.x, and every older line. Packagist, where composer audit gets its advisories, lists the same <12.68.0|>=13.0.0,<13.29.0 (07:54 JST). The release times are GitHub's (07:52 JST); 11.57.0 and 10.50.3 are tags with no GitHub release, dated by Packagist. The support column is Laravel's support policy (07:55 JST).

Take the newest release of your line, not only the fixed one. 12.68.0 and 13.29.0 still carry CVE-2026-102279, a low-severity cross-site scripting bug in the debug page, fixed in 12.69.0 and 13.30.0. In this page's Composer test (below), 12.70.1 and 13.38.0 had no advisory against them.

Two notes from the code, not from Laravel. The 13.x fix commit is already in 13.27.0 and 13.28.0, but the advisory names 13.29.0, and Packagist lists the two older ones as affected, so go to 13.29.0 or later. The 11.x branch got the same two-line change to TokenGuard.php on August 25, first tagged in 11.56.1, but Laravel hasn't announced an 11.x fix, and Packagist lists every 11.x version as affected. This page doesn't call any of these four versions fixed.

Am I affected?

Laravel's advisory says the bypass works "when configured with a standard token-based API guard" and "under certain database configurations (MySQL/MariaDB)", with "authentication bypass and account takeover on any route protected by the affected guard". Four questions follow from those words:

Four yeses is the case the advisory describes. The config:show and route:list commands are from Laravel's docs (checked 08:02 JST). The advisory makes no exception for the guard's hash, input_key, or storage_key options. It names MySQL and MariaDB, but it doesn't say which of their settings matter, or that other databases are unaffected. A no to any of the first three takes your app out of the case Laravel describes; update anyway, because composer audit and Dependabot flag the version whatever your config says.

Where a token guard comes from

From Laravel 5.2 on, the application skeleton put one into every new app's config/auth.php: a guard named api with 'driver' => 'token' (and, from 5.8, 'hash' => false). A commit titled "[8.x] Sanctum" removed it on August 11, 2021; the skeleton's v8.5.24 still has it and v8.6.0 doesn't (checked 07:55 and 08:08 JST). Updating the framework never edits that file, so an app created from an older skeleton may still carry the guard, used or not. Laravel last documented the driver in its 6.x docs, which also told you to add an api_token column to the users table, so that column is another sign. The 7.x docs dropped that page, in a commit of February 17, 2020, titled "remove old api auth docs in favor of airlock", and the current docs point API tokens to Sanctum and Passport.

Sanctum, Passport, and custom guards

Laravel's advisory doesn't mention Sanctum or Passport, and Laravel hasn't said anything else about either. Here is what each one's docs and source describe (checked 07:55 JST):

This page doesn't call Sanctum or Passport safe or affected, because Laravel hasn't. One check is worth a minute: if the list in config/sanctum.php names a guard whose driver is token, Sanctum runs that guard on your Sanctum routes too.

Update with Composer

Within your major version, one command updates the framework:

composer update laravel/framework

Run your tests and composer audit, which should show no advisory left, then commit the new composer.lock and deploy. If Composer reports that another locked package stops the update, add -W (--with-all-dependencies), which, in Composer's docs, also updates "dependencies of packages in the argument list, including those which are root requirements".

This page's test, on October 24, 07:59–08:06 JST, with Composer 2.10.3 on PHP 8.5.12 (the composer:2 Docker image): three projects that require only laravel/framework, each locked at an affected version, resolved with --ignore-platform-reqs.

Two things the test shows. First, Composer blocks versions with advisories when it picks versions: its docs say policy.advisories.block "Defaults to true" (checked 07:58 JST). On 11.x, that blocks every version your constraint allows. Second, composer install from the 12.67.0 lock installed 12.67.0, exited with 0, and printed no advisory, and composer install is the command deploy scripts run. A server keeps getting the old version until you commit a new lock. A real app with older locked dependencies may need -W where these fresh projects didn't.

On Laravel 11 or older

Composer won't update you to a fixed 11.x, because there isn't one, so the fix is a major upgrade. Laravel's guide "Upgrading To 12.0 From 11.x" starts with laravel/framework ^12.0, phpunit/phpunit ^11.0, and pestphp/pest ^3.0 in composer.json, and estimates the upgrade at 5 minutes; it lists the breaking changes to check. Laravel 12 supports PHP 8.2 to 8.5, and Laravel 13 needs 8.3 or later (support policy, 07:55 JST). From 10.x, Laravel's guide "Upgrading To 11.0 From 10.x" comes first (estimated at 15 minutes).

If you can't update today

Laravel's advisory has no workaround or mitigation section, and Laravel has published nothing else about this bug: the laravel.com blog has no post on it (checked 08:08 JST). The one limit the advisory names is its scope, "any route protected by the affected guard". A token guard that no route and none of your code uses is outside that description. One that routes use stays exposed until you update, or until those routes move to another guard, which is a change to how your API authenticates, with its own testing. The update is the fix Laravel offers.

The second advisory: CVE-2026-114508

Laravel published GHSA-5wcm-3v2w-8362 11 seconds after the first, on October 19 at 13:33 UTC. The same updates fix it, so one update covers both.

The advisory doesn't name the feature. Its fix commits change the framework's JSON:API resource classes (Illuminate\Http\Resources\JsonApi), which arrived in 12.45.0 with a pull request titled "[12.x] JSON:API Resource" (checked 08:01 JST). Laravel's docs say JsonApiResource handles "relationships, sparse fieldsets, includes", so apps that return JsonApiResource responses are the ones to look at.

How long the fix has been out

By October 24, the fix had been out for 60 days, and Laravel published the advisory 55 days after the release. GitHub's docs say "Only advisories reviewed by GitHub trigger alerts" (checked 08:02 JST), so Dependabot alerts for this CVE could not start before October 23, 21:50 UTC. Laravel has published no guidance on what to look for in logs.

CVE-2026-114509 is scored 9.2, Critical, on CVSS 4.0 by GitHub as the CVE Numbering Authority: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That is over the network, low complexity, no privileges, and no user interaction, with "attack requirements" present, which this page reads as the guard and database conditions. It has no CVSS 3.x score. GitHub's database and NVD list the weaknesses CWE-287, Improper Authentication, and CWE-1287, Improper Validation of Specified Type of Input. NVD lists the record as "Awaiting Analysis", with no score of its own (checked 08:08 JST). The advisory credits GitHub user KIKOmanasijev as the reporter.

Forge, Vapor, and Laravel Cloud

Composer's docs say composer install uses "the exact versions" in the lock file (checked 07:58 JST), so on all three hosts, the framework that runs is the one in the composer.lock you deploy. Push the updated lock and deploy. The October 21 PHP release is a separate fix with its own steps: PHP October 2026 security release: what to update.

Is CVE-2026-114509 being exploited?

No source this page checked reports attacks (checked 08:08 JST on October 24):

Update laravel/framework and deploy

1. Find your version

Run composer show laravel/framework on the server, or composer show --locked laravel/framework in your repository. 12.68.0 or later on 12.x, or 13.29.0 or later on 13.x, has the fix.

2. Look for a token guard

Run php artisan config:show auth and look for a guard whose driver is token, then php artisan route:list -v for routes that use it. Note the database driver from php artisan config:show database. If you use Sanctum, read the guard list in config/sanctum.php too.

3. Update within your major version

Run composer update laravel/framework. If Composer reports a conflict with another locked package, run composer update laravel/framework -W.

4. Test and audit

Run your test suite, then composer audit. In this page's test, 12.70.1 and 13.38.0 showed no advisories.

5. Commit the lock file and deploy

Commit composer.lock and deploy as usual. Forge, Vapor, and Laravel Cloud install what the lock file says, so the fix reaches production with this deploy and not before.

6. On 11.x or older, plan the major upgrade

Follow Laravel's upgrade guide to 12.0, and from 10.x, the guide to 11.0 first. With Composer's default advisory blocking, composer update won't install any 11.x version.

Updates to this page

• October 24, 2026, 08:08 JST: first version.

This page changes when CISA adds the CVE to its catalog or rates it in the CVE.org record, when NVD scores it, when Laravel edits either advisory (an 11.x fix, a workaround, a word on Sanctum or Passport, exploitation), when Laravel or a host posts about it, and at the next 12.x and 13.x releases. The same week: PHP October 2026 security release: what to update, Node.js October 2026 security release: what to update, GitLab CVE-2026-110264: which version to upgrade to and how, Railway security incident, October 2026: what to do now, and Pillow CVE-2026-112398 and 13.0.0: what to update.

Frequently asked questions

Which Laravel versions fix CVE-2026-114509?

12.68.0 on 12.x and 13.29.0 on 13.x, both released on August 25, 2026, and every later release on those lines. The newest on October 24 are 12.70.1 and 13.38.0.

Is Laravel 12.67 vulnerable to CVE-2026-114509?

Yes, by the advisory: every version below 12.68.0 is in its range. In this page's test, composer audit on a project locked at 12.67.0 listed CVE-2026-114509 as critical, and composer update laravel/framework moved it to 12.70.1. Whether your app can be attacked depends on the four questions above.

Is Laravel 11 affected by CVE-2026-114509?

The advisory's range, below 12.68.0, covers every 11.x version, and it names no 11.x fix. Laravel 11's security support ended on March 12, 2026. The 11.x branch's TokenGuard.php has had the same two-line change since 11.56.1, but Laravel hasn't called that a fix and Packagist lists all of 11.x as affected, so move to 12.68.0 or later.

Does Sanctum use the TokenGuard from this advisory?

Sanctum's docs tell you to protect routes with the sanctum guard, which Sanctum registers itself, and the advisory lists only laravel/framework. Laravel hasn't said more. Check one thing: Sanctum first tries the guards in config/sanctum.php (['web'] by default), so a token guard in that list runs on your Sanctum routes.

Does Passport use the affected TokenGuard?

Passport's docs call its guard "Passport's TokenGuard", but that class is Laravel\Passport\Guards\TokenGuard, in the laravel/passport package. Laravel's fix changes Illuminate\Auth\TokenGuard in laravel/framework, and the advisory doesn't mention Passport.

How do I check my Laravel version?

Run composer show laravel/framework where the app is installed, or composer show --locked laravel/framework to read composer.lock. A line such as versions : * v12.67.0 means 12.67.0.

What is the latest Laravel version?

13.38.0, released on October 20, 2026, and on 12.x, 12.70.1, released on October 21 (GitHub releases, checked 08:08 JST).

Do I need to rotate API tokens?

Laravel's advisory doesn't say. As Laravel describes it, the bug lets a request act as a user without knowing that user's token; it doesn't describe tokens being exposed. Laravel has published nothing on what to look for in logs.

Is CVE-2026-114509 being exploited?

No source checked at 08:08 JST on October 24 reports attacks: CISA's catalog doesn't list it, its CVE.org record has no CISA rating yet, and Laravel's advisory says nothing either way. Two public GitHub repositories that call themselves proofs of concept have existed since October 20 and October 22.

Is the bug only on MySQL?

The advisory names MySQL and MariaDB, "under certain database configurations", and no other database. It doesn't say which settings matter, or that PostgreSQL, SQLite, or SQL Server are unaffected, so update whatever database you run.

What is the CVSS score of CVE-2026-114509?

9.2, Critical, on CVSS 4.0, from GitHub as the CVE Numbering Authority. There is no CVSS 3.x score, and NVD lists the record as "Awaiting Analysis" with no score of its own.

Why did Dependabot or composer audit flag this only now?

GitHub reviewed the advisory into its Advisory Database on October 23, 2026, at 21:50 UTC, and its docs say "Only advisories reviewed by GitHub trigger alerts." Packagist, where composer audit gets its advisories, carries the same time. Laravel had published the advisory on October 19, and the fixed releases on August 25.

Sources

Times are in JST (UTC+9), on October 24, 2026.

• GitHub Advisory Database: GHSA-f9x3-7vq9-cph6, reviewed October 23, 2026 (07:52, 08:08) and GHSA-5wcm-3v2w-8362 (07:52)
• Laravel's repository advisories GHSA-f9x3-7vq9-cph6 and GHSA-5wcm-3v2w-8362, published October 19, 2026 (07:52; the first page also 07:56)
• CVE.org: CVE-2026-114509 and CVE-2026-114508 (07:52; CVE-2026-114509 again 08:08)
• NVD: CVE-2026-114509 and CVE-2026-114508 (07:52; CVE-2026-114509 again 08:08)
• laravel/framework releases, its tags, and the fix commits 8dbb08b, 9b21ce0, and 5056ca5 of August 25, 2026 (07:52–07:54, 08:08)
• TokenGuard.php on the 10.x branch and at v11.51.0, v11.56.1, v11.57.0, v12.67.0, v12.68.0, v13.27.0, v13.28.0, and v13.29.0 (07:53–08:06)
• Packagist: laravel/framework versions and its security advisories API (07:54)
• Laravel: Release Notes, Support Policy (07:55, 08:02)
• Laravel docs, 13.x: Authentication, Sanctum, Passport, Configuration, Routing, Eloquent: API Resources, and the upgrade guides for 12.x and 11.x; the 6.x API Authentication page (07:54–08:06)
• laravel/laravel: "[8.x] Sanctum" (#5663), August 11, 2021, and config/auth.php at v5.2.0, v5.7.0, v5.8.0, v8.0.0, v8.5.24, and v8.6.0 (07:55, 08:08, 08:36); laravel/docs: "remove old api auth docs in favor of airlock", February 17, 2020 (08:03)
• laravel/sanctum config/sanctum.php and src/Guard.php (07:55); laravel/passport src/Guards/TokenGuard.php (07:55)
• laravel/framework pull requests #61322 and #61323, merged August 24, 2026, and the v12.45.0 release notes (08:01)
• Composer docs: Command-line interface (install, update, audit) and Config (policy.advisories.block) (07:58)
• GitHub Docs: About Dependabot alerts (08:02)
• CISA Known Exploited Vulnerabilities catalog, version 2026.10.23 (07:56, 08:08)
• GitHub repository search for CVE-2026-114509 (07:57, 08:08; counted, not opened)
• Laravel Forge: Deployments, Laravel Cloud: Deployments, and Laravel Vapor: Deployments (07:58–08:05)
• Laravel blog: PHP critical vulnerability response updates, October 21, 2026, updated October 23, 08:31 UTC (07:59), and the Laravel blog index (07:58, 08:08)