Laravel Authentication Bypass PoC Released for Critical TokenGuard Flaw CVE-2026-114509
Do Son 
TL;DR
Hakai Security has released a public proof-of-concept for CVE-2026-114509, a critical Laravel authentication bypass in the built-in TokenGuard. The flaw, rated CVSS 9.2, lets an unauthenticated attacker log in as an existing user on MySQL or MariaDB backends. Laravel 12.68.0 and 13.29.0 fix it.
- CVE: CVE-2026-114509
- CVSS: 9.2 (Critical · CVSSv4)
- Product: laravel framework
- Affected: < 12.68.0, >= 13.0.0, < 13.29.0
- Impact: Laravel TokenGuard authentication bypass through non-string API credentials
- Status: No confirmed exploitation yet
- PoC: Available (Nuclei)
- EPSS: 1.8% (30-day)
- Action: See vendor advisory
Why It Matters
Laravel is one of the most popular PHP frameworks, and many apps protect their APIs with the auth:api guard. A successful attack needs no stolen token. Instead, it leads to “authentication bypass and account takeover on any route protected by the affected guard.” Notably, this Laravel authentication bypass only affects apps that store users in MySQL or MariaDB.
Details and PoC are public
Laravel’s TokenGuard security advisory went live on October 19 and credits researcher KIKOmanasijev. Days later, Hakai Security published a Laravel TokenGuard bypass PoC on GitHub. It ships a Docker lab that shows the attack working on a vulnerable build and failing on a patched one.
How the Attack Works
TokenGuard checked only whether a token was empty. It did not check that the token was a string. As a result, an attacker can send a “specially crafted, non-string credential value” in a JSON request.
MySQL and MariaDB then compare the stored text tokens as numbers. Most tokens convert to the same value, so the lookup “match[es] an unintended user record.” The guard then treats the request as logged in. According to the PoC write-up, the trick only works through a JSON request body, not a query string.
Exploitation status
A public PoC exists. However, no source confirms this Laravel authentication bypass in the wild, and it is not in CISA’s KEV catalog.
Affected Versions
- Laravel 13.x before 13.29.0
- Laravel 12.x before 12.68.0
- Laravel 11.x before 11.56.1, per the PoC authors
Patch and Mitigation Steps
- Upgrade to Laravel 13.29.0, 12.68.0 or 11.56.1.
- Review logs for odd logins on token-protected routes.
- Rotate API tokens if you suspect abuse.
Laravel lists no workaround. Since PoC code is now public, patch this TokenGuard flaw right away.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
