CVE-2026-114509
CVE-2026-114509 · Laravel TokenGuard authentication bypass through non-string API credentials
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
CVSS 9.2 · Critique · EPSS 0,8% · Code d’exploitation public · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
framework
- Versions du logiciel
- < 12.68.0: Concernée
- >= 13.0.0, < 13.29.0: Concernée
Aucun correctif publié
laravel/framework Packagist
- Versions du logiciel
- v13.0.0
- v13.1.0
- v13.1.1
- v13.10.0
- v13.11.0
- v13.11.1
- v13.11.2
- v13.12.0
- v13.13.0
- v13.14.0
- v13.15.0
- v13.16.0
- v13.16.1
- v13.17.0
- v13.18.0
- v13.18.1
- v13.19.0
- v13.2.0
- v13.20.0
- v13.21.0
- v13.21.1
- v13.22.0
- v13.23.0
- v13.24.0
- v13.25.0
- v13.26.0
- v13.26.1
- v13.27.0
- v13.28.0
- v13.3.0
- v13.4.0
- v13.5.0
- v13.6.0
- v13.7.0
- v13.8.0
- v13.9.0
- Plages de versions concernées
- ECOSYSTEM: ≥ 13.0.0, < 13.29.0
Mettez à jour vers 13.29.0
laravel/framework Packagist
- Versions du logiciel
- 10.50.2
- 5.0.30
- 5.2.41
- v10.0.0
- v10.0.1
- v10.0.2
- v10.0.3
- v10.1.0
- v10.1.1
- v10.1.2
- v10.1.3
- v10.1.4
- v10.1.5
- v10.10.0
- v10.10.1
- v10.11.0
- v10.12.0
- v10.13.0
- v10.13.1
- v10.13.2
- v10.13.3
- v10.13.5
- v10.14.0
- v10.14.1
- v10.15.0
- v10.16.0
- v10.16.1
- v10.17.0
- v10.17.1
- v10.18.0
- v10.19.0
- v10.2.0
- v10.20.0
- v10.21.0
- v10.21.1
- v10.22.0
- v10.23.0
- v10.23.1
- v10.24.0
- v10.25.0
- v10.25.1
- v10.25.2
- v10.26.0
- v10.26.1
- v10.26.2
- v10.27.0
- v10.28.0
- v10.29.0
- v10.3.0
- v10.3.1
- v10.3.2
- v10.3.3
- v10.30.0
- v10.30.1
- v10.31.0
- v10.32.0
- v10.32.1
- v10.33.0
- v10.34.0
- v10.34.1
- v10.34.2
- v10.35.0
- v10.36.0
- v10.37.0
- v10.37.1
- v10.37.2
- v10.37.3
- v10.38.0
- v10.38.1
- v10.38.2
- v10.39.0
- v10.4.0
- v10.4.1
- v10.40.0
- v10.41.0
- v10.42.0
- v10.43.0
- v10.44.0
- v10.45.0
- v10.45.1
- v10.46.0
- v10.47.0
- v10.48.0
- v10.48.1
- v10.48.10
- v10.48.11
- v10.48.12
- v10.48.13
- v10.48.14
- v10.48.15
- v10.48.16
- v10.48.17
- v10.48.18
- v10.48.19
- v10.48.2
- v10.48.20
- v10.48.21
- v10.48.22
- v10.48.23
- v10.48.24
- v10.48.25
- v10.48.26
- v10.48.27
- v10.48.28
- v10.48.29
- v10.48.3
- v10.48.4
- v10.48.5
- v10.48.6
- v10.48.7
- v10.48.8
- v10.48.9
- v10.49.0
- v10.49.1
- v10.5.0
- v10.5.1
- v10.50.0
- v10.50.1
- v10.50.3
- v10.6.0
- v10.6.1
- v10.6.2
- v10.7.0
- v10.7.1
- v10.8.0
- v10.9.0
- v11.0.0
- v11.0.1
- v11.0.2
- v11.0.3
- v11.0.4
- v11.0.5
- v11.0.6
- v11.0.7
- v11.0.8
- v11.1.0
- v11.1.1
- v11.10.0
- v11.11.0
- v11.11.1
- v11.12.0
- v11.13.0
- v11.14.0
- v11.15.0
- v11.16.0
- v11.17.0
- v11.18.0
- v11.18.1
- v11.19.0
- v11.2.0
- v11.20.0
- v11.21.0
- v11.22.0
- v11.23.0
- v11.23.1
- v11.23.2
- v11.23.3
- v11.23.4
- v11.23.5
- v11.24.0
- v11.24.1
- v11.25.0
- v11.26.0
- v11.27.0
- v11.27.1
- v11.27.2
- v11.28.0
- v11.28.1
- v11.29.0
- v11.3.0
- v11.3.1
- v11.30.0
- v11.31.0
- v11.32.0
- v11.33.0
- v11.33.1
- v11.33.2
- v11.34.0
- v11.34.1
- v11.34.2
- v11.35.0
- v11.35.1
- v11.36.0
- v11.36.1
- v11.37.0
- v11.38.0
- v11.38.1
- v11.38.2
- v11.39.0
- v11.39.1
- v11.4.0
- v11.40.0
- v11.41.0
- v11.41.1
- v11.41.2
- v11.41.3
- v11.42.0
- v11.42.1
- v11.43.0
- v11.43.1
- v11.43.2
- v11.44.0
- v11.44.1
- v11.44.2
- v11.44.3
- v11.44.4
- v11.44.5
- v11.44.6
- v11.44.7
- v11.45.0
- v11.45.1
- v11.45.2
- v11.45.3
- v11.46.0
- v11.46.1
- v11.46.2
- v11.47.0
- v11.48.0
- v11.49.0
- v11.5.0
- v11.50.0
- v11.51.0
- v11.52.0
- v11.53.0
- v11.53.1
- v11.54.0
- v11.55.0
- v11.55.1
- v11.56.0
- v11.56.1
- v11.57.0
- v11.6.0
- v11.7.0
- v11.8.0
- v11.9.0
- v11.9.1
- v11.9.2
- v12.0.0
- v12.0.1
- v12.1.0
- v12.1.1
- v12.10.0
- v12.10.1
- v12.10.2
- v12.11.0
- v12.11.1
- v12.12.0
- v12.13.0
- v12.14.0
- v12.14.1
- v12.15.0
- v12.16.0
- v12.17.0
- v12.18.0
- v12.19.0
- v12.19.1
- v12.19.2
- v12.19.3
- v12.2.0
- v12.20.0
- v12.21.0
- v12.22.0
- v12.22.1
- v12.23.0
- v12.23.1
- v12.24.0
- v12.25.0
- v12.26.0
- v12.26.1
- v12.26.2
- v12.26.3
- v12.26.4
- v12.27.0
- v12.27.1
- v12.28.0
- v12.28.1
- v12.29.0
- v12.3.0
- v12.30.0
- v12.30.1
- v12.31.0
- v12.31.1
- v12.32.0
- v12.32.1
- v12.32.2
- v12.32.3
- v12.32.4
- v12.32.5
- v12.33.0
- v12.34.0
- v12.35.0
- v12.35.1
- v12.36.0
- v12.36.1
- v12.37.0
- v12.38.0
- v12.38.1
- v12.39.0
- v12.4.0
- v12.4.1
- v12.40.0
- v12.40.1
- v12.40.2
- v12.41.0
- v12.41.1
- v12.42.0
- v12.43.0
- v12.43.1
- v12.44.0
- v12.45.0
- v12.45.1
- v12.45.2
- v12.46.0
- v12.47.0
- v12.48.0
- v12.48.1
- v12.49.0
- v12.5.0
- v12.50.0
- v12.51.0
- v12.52.0
- v12.53.0
- v12.54.0
- v12.54.1
- v12.55.0
- v12.55.1
- v12.56.0
- v12.57.0
- v12.58.0
- v12.59.0
- v12.6.0
- v12.60.0
- v12.60.1
- v12.60.2
- v12.61.0
- v12.61.1
- v12.62.0
- v12.63.0
- v12.64.0
- v12.65.0
- v12.66.0
- v12.67.0
- v12.7.0
- v12.7.1
- v12.7.2
- v12.8.0
- v12.8.1
- v12.9.0
- v12.9.1
- v12.9.2
- v4.0.0
- v4.0.0-BETA2
- v4.0.0-BETA3
- v4.0.0-BETA4
- v4.0.1
- v4.0.10
- v4.0.11
- v4.0.2
- v4.0.3
- v4.0.4
- v4.0.5
- v4.0.6
- v4.0.7
- v4.0.8
- v4.0.9
- v4.1.0
- v4.1.1
- v4.1.10
- v4.1.11
- v4.1.12
- v4.1.13
- v4.1.14
- v4.1.15
- v4.1.16
- v4.1.17
- v4.1.18
- v4.1.19
- v4.1.2
- v4.1.20
- v4.1.21
- v4.1.22
- v4.1.23
- v4.1.24
- v4.1.25
- v4.1.26
- v4.1.27
- v4.1.28
- v4.1.29
- v4.1.3
- v4.1.30
- v4.1.31
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.2.0
- v4.2.0-BETA1
- v4.2.1
- v4.2.10
- v4.2.11
- v4.2.12
- v4.2.13
- v4.2.14
- v4.2.15
- v4.2.16
- v4.2.17
- v4.2.18
- v4.2.19
- v4.2.2
- v4.2.20
- v4.2.21
- v4.2.22
- v4.2.3
- v4.2.4
- v4.2.5
- v4.2.6
- v4.2.7
- v4.2.8
- v4.2.9
- v5.0.0
- v5.0.1
Mettez à jour vers 12.68.0
Sources originales
- https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
- https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
- https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.29.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-114509