#authentication-bypass

Deep Dive

Laravel rates CVE-2026-114509 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can sign in as an existing user of the legacy token API guard on MySQL or MariaDB by sending a JSON body like {"api_token": [0]}, without knowing any valid API token. Fixed in 12.68.0 and 13.29.0, with the fix also present in the 11.56.1 tag. A public proof of concept has existed since October 22, 2026, and no exploitation in the wild is known.