Laravel Patches Critical Token Guard Auth Bypass

Past-week coverage · Original source published 2026-10-20.

Laravel disclosed a critical authentication bypass in its built-in token API guard, tracked as GHSA-f9x3-7vq9-cph6 with a CVSS v4 score of 9.2. The advisory was published on Monday, October 19, and credited researcher Hristijan Manasijev. No CVE identifier had been assigned at the time of writing.

The bug sits in Illuminate\Auth\TokenGuard, the class behind the token guard driver that protects auth:api routes. Only applications storing their users table in MySQL or MariaDB can be exploited. According to Laravel News, Sanctum and Passport register their own guard drivers and are not covered by the advisory.

Before the fix, the guard only checked that the submitted token was not empty. An attacker could send a JSON body of {"api_token":[0]}, so the token arrived as a PHP array holding the integer 0, which counts as non-empty. Eloquent's user provider turned array values into a whereIn() clause, and the query compared the text api_token column against an integer. MySQL and MariaDB compare numerically, so any stored token not starting with a digit converts to 0 and the first such row matches. The advisory says the query matches "an unintended user record rather than failing authentication as expected."

Rafael Felix and Gabriel Rodrigues of Hakai Offensive Security's Yokai Research team published a technical analysis and a Python exploit with a Docker lab. Their testing found the integer must come from a JSON body; a query-string array binds a string that the database does not cast. The exploit authenticates as the first user whose token starts with a letter, and can reach users whose tokens start with a specific digit by sending values from 0 to 9.

The fix adds an is_string() check to the guard's user() and validate() methods, rejecting arrays and other non-string values before any database query runs. Hakai dated Taylor Otwell's commits to August 24–25, 2026. Laravel News said versions 12.68.0 and 13.29.0 were released on August 25, almost two months before the advisory went public.

The sources disagree on which versions are patched. The advisory lists every release below 12.68.0 as affected, and Laravel News reported patches only for the 12.x and 13.x branches. Hakai's review of the Git history found the fix first shipped in v13.27.0 and was backported to 11.x as v11.56.1, a release the advisory does not mention.

Manasijev also reported a second, medium-severity flaw published the same day. GHSA-5wcm-3v2w-8362 (CVSS 6.5) lets a crafted request to a read-only JSON:API resource endpoint trigger a destructive database operation on a related table. It affects versions 12.45.0 through 12.67.x and 13.x releases before 13.27.0.

Cyber Kendra found no reports of in-the-wild exploitation as of Wednesday. Developers should update laravel/framework to 13.29.0 or 12.68.0, or to 11.56.1 on the 11.x branch. Apps with a guard set to the token driver in config/auth.php that run on MySQL or MariaDB should be patched first. Running composer audit checks installed packages against published advisories.