CVE-2026-114509: The Laravel TokenGuard Auth Bypass — Are You Actually Affected? (2026)
CVE-2026-114509 at a glance CVE-2026-114509 is a critical authentication bypass in Laravel’s built-in TokenGuard, rated CVSS 9.2 (Critical, CVSS 4.0). An unauthenticated attacker can submit a crafted non-string credential that, on certain MySQL or MariaDB configurations, matches an unintended user record — authenticating as another user without ever knowing a valid API token. The issue … Read more