Laravel is a web application framework.
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Oracle, PHP
- Product
- MySQL, MariaDB, PHP
- Fix
- available
- Exposure class
- Database, Web platform
Why it ranks 16 (Routine)
- Product class: database, web platform
- Widely deployed vendor product (Oracle)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-114509 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.