CVE-2026-114509
1 advisory.
Packagist/laravel/framework CVE-2026-114509: critical
Laravel TokenGuard authentication bypass through non-string API credentials
Action: Upgrade laravel/framework to 12.68.0 (12.x) or 13.29.0 (13.x) or later.
composer require laravel/framework:13.29.0composer require laravel/framework:12.68.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.0.0 | 13.29.0 | - |
| 0 | 12.68.0 | - |
Fixed versions
| 13.29.0 | 12.68.0 |
Sources
- osv: GHSA-f9x3-7vq9-cph6
- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://nvd.nist.gov/vuln/detail/CVE-2026-114509
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.29.0
CVE-2026-114509 · published · modified · JSON