{"action":"Upgrade laravel/framework to 12.68.0 (12.x) or 13.29.0 (13.x) or later.","affected":[{"fixed":"13.29.0","introduced":"13.0.0"},{"fixed":"12.68.0","introduced":"0"}],"component":"laravel/framework","cve_ids":["CVE-2026-114509"],"ecosystem":"Packagist","epss":0.0184,"exploited":false,"fixed_versions":["13.29.0","12.68.0"],"ghsa_id":"GHSA-f9x3-7vq9-cph6","id":"tcs_01M5NDPAE2VM7W0ZT13KK7WVV9","modified_at":"2026-10-23T22:00:04.255898562Z","published_at":"2026-10-23T21:50:27Z","references":["https://osv.dev/vulnerability/GHSA-f9x3-7vq9-cph6","https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6","https://nvd.nist.gov/vuln/detail/CVE-2026-114509","https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5","https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c","https://github.com/laravel/framework","https://github.com/laravel/framework/releases/tag/v12.68.0","https://github.com/laravel/framework/releases/tag/v13.29.0"],"severity":{"label":"critical","score":9.2},"sources":[{"source":"osv","source_id":"GHSA-f9x3-7vq9-cph6","url":"https://osv.dev/vulnerability/GHSA-f9x3-7vq9-cph6"},{"source":"nvd","source_id":"CVE-2026-114509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114509"}],"summary":"Laravel TokenGuard authentication bypass through non-string API credentials"}