Critical Laravel TokenGuard Flaw (CVSS 9.2) Lets Attackers Log In as Any User
Do Son 
TL;DR
Laravel published two security advisories on October 19, 2026. The more serious one is a critical Laravel authentication bypass in TokenGuard, rated CVSS 9.2, that can lead to account takeover. A second, moderate flaw lets read-only users wipe related database tables.
Why It Matters
Laravel is one of the most widely used PHP frameworks, and many APIs rely on its token guard. This Laravel authentication bypass needs no login and no valid token. As a result, any route protected by the affected guard could be exposed.
How the Attacks Work
TokenGuard authentication bypass (CVSS 9.2)
The first advisory, GHSA-f9x3-7vq9-cph6, affects apps on MySQL or MariaDB. The framework mishandles a crafted, non-string credential during the login lookup. Instead of failing, the query can match the wrong user record.
Laravel warns that “an unauthenticated attacker may authenticate as another user without possessing that user’s API token.” In practice, this means account takeover.
Unauthorized data destruction (CVSS 6.5)
The second advisory, GHSA-5wcm-3v2w-8362, involves relationship inclusion on read endpoints. A crafted request can trigger a destructive database operation on a related table. According to Laravel, a user with read access “could cause irreversible data loss.”
Exploitation status
Neither flaw has a CVE ID yet. No exploitation in the wild or public PoC has been confirmed.
Affected Versions
- TokenGuard bypass: laravel/framework before 12.68.0, and 13.x before 13.29.0
- Data destruction: 12.x from 12.45.0 before 12.68.0, and 13.x before 13.27.0
Patch and Mitigation Steps
- Upgrade to Laravel 13.29.0, or 12.68.0 on the 12.x branch. These releases fix both flaws.
- Review logs for unusual logins on token-protected API routes, especially from unknown IP addresses.
- Back up databases behind read endpoints that load relationships.
Because the Laravel authentication bypass requires no credentials, teams running MySQL or MariaDB should patch first.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
