- Laravel's advisory GHSA-f9x3-7vq9-cph6 says its token guard could let an unauthenticated attacker log in as an existing user on MySQL or MariaDB. Laravel News reports a CVSS score of 9.2.
- Laravel News says the old guard never tested the type of the token. Fixes that add a text-type test are in Laravel 12.68.0 and 13.29.0, released August 25, 2026.
- Check config/auth.php for token-driver guards, update laravel/framework, and run composer audit. Follow advisory feeds as well as CVE databases.
A check for something, not for the right thing
A door that checks only that you handed over an object, and not that the object is a key, is not much of a door. That is the shape of a flaw in Laravel's token-based API login.
Laravel published advisory GHSA-f9x3-7vq9-cph6 for its built-in TokenGuard. It describes a way to sign in as any existing user with no knowledge of that person's API token, and with no prior login. The advisory names account takeover on any route the affected guard protects as the result.
Laravel News reports a CVSS severity score of 9.2 for the advisory. CVSS is the standard 0-to-10 scale for rating vulnerabilities. The advisory text provided to WebPulse gives no CVE ID, so this article uses the advisory ID.
How the bypass works
An API token is a long secret string. A client sends it with each request, and the server looks up which user owns it. The component that does the lookup is called the user provider.
Laravel News describes the old guard as asking one question of the incoming token: is anything there? If so, the guard passed it to the user provider. It never tested what kind of value the token was.
The advisory ties the problem to MySQL and MariaDB. On those databases, a crafted value that is not text can confuse the lookup. Instead of finding nothing and refusing entry, the query lands on someone else's account.
The advisory does not explain why those databases behave this way, and WebPulse does not speculate. The practical point is simpler. The login code accepted input of a shape its designers did not intend, and the database answered anyway.
Who is affected, and who is not listed
Laravel News says an app uses the vulnerable guard if a guard in config/auth.php uses the token driver. The same outlet says the advisory lists every version below 12.68.0 as affected. Fixed releases were issued for just two branches, 12.x and 13.x.
The sources state only the 12.68.0 lower bound. They do not say which 13.x releases are affected. Apps on any 13.x release should therefore also move to 13.29.0 or later.
Sanctum and Passport, two separate Laravel packages, ship their own guard code. Laravel News notes the advisory leaves them out. Teams should still confirm which guard each API route uses rather than assume.
Hristijan Manasijev reported the issue. According to Laravel News, the patch adds a type test, is_string(), in the guard's user() and validate() methods. Arrays and any other non-text input are now turned away before the database sees them.
The fix is small. The open question is how fast it arrives.
Laravel News says both fixed versions, 12.68.0 and 13.29.0, shipped on August 25, 2026. Apps updated since then already have the fix. Apps that have not been updated are exposed if they use the token driver on MySQL or MariaDB.
The same outlet reports a second advisory, GHSA-5wcm-3v2w-8362, published the same day. Laravel News gives it a 6.5 on the CVSS v3.1 scale, in the medium band. The flaw sits in the JSON:API resources feature that arrived in Laravel 12.45.
The advisory says that under specific conditions, a request that should only fetch data can be shaped to destroy records in a related table. In practice, Laravel News says, an account allowed only to view data could wipe a connected table clean.
Together, the two advisories show one pattern worth noting. In both, a request did more than its author intended. That is a scoped observation about these two reports, not a trend.
Watch advisory feeds, not only CVE lists
WebPulse's CVE profile for Laravel, built from NIST's National Vulnerability Database and refreshed October 20, 2026, shows 9 CVEs in total and none in the last 12 months.
The advisory text provided to WebPulse lists no CVE ID for this flaw. The sources do not say whether one has been or will be assigned.
Advisories can appear on GitHub before a CVE entry exists, or without one. Teams that follow only CVE databases may therefore see a delay. Advisory feeds should be part of the watch list as well.
What to ask your team
Ask which applications run Laravel, and on which version. Anything below 12.68.0 is listed as affected, and 13.x apps should move to 13.29.0 or later. Laravel News's guidance is to move laravel/framework to 12.68.0, 13.29.0 or a later release through Composer, the PHP package manager.
Ask whether any guard in config/auth.php uses the token driver. The outlet suggests starting with any app that pairs such a guard with MySQL or MariaDB.
Ask whether dependency audits run automatically. Laravel News suggests composer audit, which compares installed packages against published advisories. Ask also whether advisory feeds reach the people who patch.
Ask what happens to apps on older branches. Fixes exist only for 12.x and 13.x, so those apps need an upgrade plan, not a quick fix.
The lesson is plain. Login code should check what a credential is, not only that one was supplied.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Laravel (laravel/framework project, via GitHub Security Advisories).
