Critical Authentication Bypass Vulnerability in Laravel Token Guard

• •Critical authentication bypass allows unauthenticated access to user accounts.
• •Affected Laravel versions are below 12.68.0 and 13.29.0, specifically on MySQL/MariaDB.
• •A proof-of-concept exploit is publicly available, increasing the urgency to patch.

Laravel disclosed a critical authentication bypass vulnerability in its token API guard, tracked as GHSA-f9x3-7vq9-cph6. The flaw allows unauthenticated attackers to log in as existing users on applications using MySQL or MariaDB, without knowing valid API tokens. The vulnerability, which has a CVSS score of 9.2, affects Laravel framework versions prior to 12.68.0 and 13.29.0. A proof-of-concept exploit is publicly available, demonstrating how attackers can exploit the flaw by sending a specific JSON body. The issue was reported by researcher Hristijan Manasijev and was fixed in versions released on August 25, 2026. Laravel's advisory was published on October 19, 2026, detailing the vulnerability and the necessary updates. The fix includes an is_string() check to prevent non-string values from being processed. The vulnerability does not affect applications using Sanctum or Passport guard drivers.