Laravel framework TokenGuard · Public exploit code

Public PoC for critical Laravel TokenGuard bypass; 2.8 million installs exposed

Oct 22, 2026 · 1 min read

A critical Laravel TokenGuard flaw (CVE-2026-114509, CVSS 9.2) lets an unauthenticated attacker impersonate any existing user without their API token, under certain MySQL/MariaDB configurations. A public PoC is circulating and FOFA lists more than 2.8 million internet-facing Laravel installations; the sources report no in-the-wild exploitation. Update laravel/framework to 12.68.0 or 13.29.0.

By HIFY Radar newsroom Updated 10/26/2026 04:10 PM Get this every day →← Back to the feed 4 sources

CriticalVulnerabilityPublic exploit codePatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Laravel fixed a critical authentication flaw in TokenGuard (CVE-2026-114509). An attacker without credentials could authenticate as any existing API user without knowing that user's token. The flaw depends on certain MySQL or MariaDB database configurations, and a public proof of concept already exists.

Why it matters

API routes protected by the affected guard are open to account takeover, exposing the targeted user's data and actions. FOFA reports more than 2.8 million internet-facing Laravel installations, which widens the target. Severity is critical, CVSS 9.2.

What to do

Update the laravel/framework package to 12.68.0 on line 12 or 13.29.0 on line 13. Then review API authentication logs for anomalous access and confirm which applications use token-based API authentication.

For the technical team

CVE: CVE-2026-114509
Affected: Laravel framework TokenGuard (laravel/framework) · laravel/framework < 12.68.0; laravel/framework >= 13.0.0, < 13.29.0 (Composer).
Exploitation: Public PoC circulating, per the incident timeline and the @fofabot post. No production exploitation reported in the sources. EPSS 0.696% (53rd percentile) in the GitHub advisory.
Fix: Update to laravel/framework 12.68.0 (line 12) or 13.29.0 (line 13). Fix commits cited in the advisory: 8dbb08b and 9b21ce0.
Vector: Laravel TokenGuard configured as the standard token-based API guard. Under certain database configurations (MySQL/MariaDB), a specially crafted non-string credential value is mishandled during the authentication lookup, making the underlying query match an unintended user record. Network exploitable, no privileges required, no user interaction (CVSS v4 9.2, AT:P).
More details: Advisory GHSA-f9x3-7vq9-cph6 published by andrei-laravel on Oct 19, 2026, published to NVD on Oct 21, 2026, reviewed Oct 23, 2026. CWE-287 (Improper Authentication) and CWE-1287 (Improper Validation of Specified Type of Input). A FOFA scan with query app="Laravel-Framework" found more than 2.8 million internet-facing Laravel surfaces in the past year, per @fofabot.

Timeline

10/26/2026 04:10 PM
A public PoC is circulating and FOFA scans identify more than 2.8 million internet-facing Laravel installs.
10/26/2026 01:11 PM
Incident opened.