Laravel Framework: Authentication Bypass (CVE-2026-114509)
A critical authentication bypass vulnerability exists in the Laravel token guard driver due to improper handling of JSON array input, allowing unauthorized access when using MySQL/MariaDB.
CVE search metadata
CVE search record: CVE-2026-114509. EPSS: 0.40%. KEV: no. Brief: Laravel Framework: Authentication Bypass (CVE-2026-114509). Brief link: https://feed.craftedsignal.io/briefs/2026-10-laravel-tokenguard-bypass/
Triage facts
Revision 2- Evidence
- Not observed
- Severity
- Critical
- Sources
- 8 public sources
- Freshness
- Revision 2Oct 23, 23:02 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A
Revision history 1 entry · Revision 2
- Revision 2
new vendor
Changed: affected_vendors, cves, lastmod, references, updates
Sources: 1
A public exploit has been published for CVE-2026-114509, a critical (CVSS 9.2) authentication bypass vulnerability in the Laravel token guard driver. The vulnerability allows an unauthenticated attacker to bypass authentication via JSON array injection (e.g., {"api_token": [0]}) when using a MySQL or MariaDB database. The application's failure to validate the input type combined with MySQL's implicit type coercion allows the bypass. PostgreSQL and SQLite are not affected.