Laravel CVE-2026-114509 (GHSA-f9x3-7vq9-cph6) TokenGuard authentication bypass on MySQL/MariaDB: am I affected and which laravel/framework version fixes it?

What it is: a critical (CVSS 9.2) flaw in Laravel's built-in TokenGuard, the simple API guard used with 'driver' => 'token'. The guard did not reject a credential that isn't a plain string. With MySQL or MariaDB and certain configurations, the token lookup could then match an existing user, so an unauthenticated request could be treated as logged in as someone else on routes protected by that guard. The fix shipped quietly on August 25, 2026; the advisory came out in October. Am I affected? Only if ALL of these are true: - laravel/framework before 12.68.0 (12.x) or before 13.29.0 (13.x), - a guard in config/auth.php uses 'driver' => 'token' (often the 'api' guard in older apps), and - the users table is on MySQL or MariaDB. Sanctum and Passport are not covered by this advisory. Apps using only session auth are not affected. How to check: - composer show laravel/framework (or grep -A3 '"name": "laravel/framework"' composer.lock) for the version. - grep -n "'driver' => 'token'" config/auth.php for a token guard, and check which routes use it (auth:api middleware). Fix: composer update laravel/framework to 12.68.0 / 13.29.0 or later, then deploy and clear cached config (php artisan optimize:clear). Interim mitigation: if you can't upgrade, switch the guard to Sanctum, or add a check that rejects requests where the api_token (or your configured input key) is not a string before the guard runs. After: review logs for API requests to token-guarded routes with unusual api_token values, look for unexpected actions by user accounts through the API, and rotate API tokens for users you can't rule out. Sources: https://laravel-news.com/laravel-token-guard-auth-bypass https://github.com/advisories/GHSA-f9x3-7vq9-cph6 https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html