Cve-2026-114509 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-114509/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 07:48:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLaravel Framework: Authentication Bypass (CVE-2026-114509)https://feed.craftedsignal.io/briefs/2026-10-laravel-tokenguard-bypass/Thu, 22 Oct 2026 07:48:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-laravel-tokenguard-bypass/A critical authentication bypass vulnerability exists in the Laravel token guard driver due to improper handling of JSON array input, allowing unauthorized access when using MySQL/MariaDB.A public exploit has been published for CVE-2026-114509, a critical (CVSS 9.2) authentication bypass vulnerability in the Laravel token guard driver. The vulnerability allows an unauthenticated attacker to bypass authentication via JSON array injection (e.g., {"api_token": [0]}) when using a MySQL or MariaDB database. The application's failure to validate the input type combined with MySQL's implicit type coercion allows the bypass. PostgreSQL and SQLite are not affected.

]]>criticaladvisorylaravelauthentication-bypasscve-2026-114509