Critical Laravel TokenGuard flaw allows account takeover

Laravel patched CVE-2026-114509 (CVSS 9.2), a flaw in its built-in token API guard that lets an unauthenticated attacker sign in as an existing user on MySQL or MariaDB without a valid token. It is fixed in laravel/framework 12.68.0 and 13.29.0; apps using Sanctum, Passport or session logins are unaffected.

• CVSS 9.2 (9.8 under CVSS 3.1); no account, password or token required
• Fixed in laravel/framework 12.68.0 and 13.29.0; no official workaround
• Only apps using the 'token' driver with users in MySQL/MariaDB are exposed
• No confirmed attacks as of October 24, but a PoC is public on GitHub