Security1 hOctober 23, 2026, 21:46

Critical Laravel Token Guard auth bypass disclosed

A CVSS 9.2 flaw (GHSA-f9x3-7vq9-cph6) in Laravel's TokenGuard lets an unauthenticated visitor log in as an existing user without knowing their token. It affects apps using the token driver on MySQL or MariaDB; fixed in laravel/framework 13.29.0 and 12.68.0.

DEV Community

Open source

Critical Laravel Token Guard auth bypass disclosed

Flaw affects guards with 'driver' => 'token' in config/auth.php
Fixed in 13.29.0 for Laravel 13 and 12.68.0 for Laravel 12
Sanctum, Passport and the session guard are not affected
Public PoC exists; no attacks in the wild reported yet

#Laravel#MySQL#MariaDB

Unbound DNSSEC heap overflow and CoreDNS auth bypass disclosed

Security

LiteLLM auth bypass: a one-character token unlocked MCP tools

Software

MariaDB: LLM coding assistants ignore its vector search

Security

Critical Laravel Token Guard auth bypass disclosed

Unbound DNSSEC heap overflow and CoreDNS auth bypass disclosed

LiteLLM auth bypass: a one-character token unlocked MCP tools

MariaDB: LLM coding assistants ignore its vector search

HPE patches 72 ArubaOS flaws, including eight max-severity RCE and auth bypass bugs