{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-114509/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-114509"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["laravel","authentication-bypass","cve-2026-114509"],"_cs_type":"advisory","_cs_vendors":["Laravel"],"content_html":"\u003cp\u003eA public exploit has been published for CVE-2026-114509, a critical (CVSS 9.2) authentication bypass vulnerability in the Laravel \u003ccode\u003etoken\u003c/code\u003e guard driver. The vulnerability allows an unauthenticated attacker to bypass authentication via JSON array injection (e.g., \u003ccode\u003e{\u0026quot;api_token\u0026quot;: [0]}\u003c/code\u003e) when using a MySQL or MariaDB database. The application's failure to validate the input type combined with MySQL's implicit type coercion allows the bypass. PostgreSQL and SQLite are not affected.\u003c/p\u003e\n","date_modified":"2026-10-23T23:02:10Z","date_published":"2026-10-22T07:48:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-laravel-tokenguard-bypass/","summary":"A critical authentication bypass vulnerability exists in the Laravel token guard driver due to improper handling of JSON array input, allowing unauthorized access when using MySQL/MariaDB.","title":"Laravel Framework: Authentication Bypass (CVE-2026-114509)","url":"https://feed.craftedsignal.io/briefs/2026-10-laravel-tokenguard-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-114509","version":"https://jsonfeed.org/version/1.1"}