Act today if this applies to you

CVE-2026-114509 is a critical (CVSS 9.2) flaw in Laravel’s built-in token API guard. If your app authenticates API requests with the "token" driver and stores users in MySQL or MariaDB, an attacker with no account can sign in as an existing user, without that user’s token. Update laravel/framework to 12.68.0 or 13.29.0 or later. Apps that use only Sanctum, Passport or session logins are not affected by this flaw.

9.2 - CVSS v4 base score, rated critical (9.8 under CVSS 3.1)

0 - accounts, passwords or tokens the attacker needs

12.68 · 13.29 - the fixed laravel/framework releases

0 - official workarounds: updating is the fix

Laravel published the advisory on 19 October 2026. It affects a feature many teams forget they still have: the simple token guard that older Laravel apps used for their API before Sanctum existed. If your site or product was started a few years ago and has a mobile app, an integration or a partner API, it is worth five minutes to check.…