A critical vulnerability in Laravel's built-in token API guard lets an unauthenticated visitor log in as an existing user without knowing that user's token. The Laravel team fixed it in August 2026, but the advisory only went public on 19 October 2026, and details and a public proof of concept followed within days. It is rated CVSS 9.2. Most modern Laravel apps are not exposed, because the guard has to be switched on in your config, but if yours is, this is a same-day update. Below: who is affected, a 2-minute check, the fix, and why it happens. I confirmed the root cause on a real MariaDB database and compared the code before and after the fix.

The short version

What: authentication bypass in Illuminate\Auth\TokenGuard , tracked as GHSA-f9x3-7vq9-cph6, CVSS v4.0 9.2.

Who: apps that use a guard with 'driver' => 'token' in config/auth.php , with users stored in MySQL or MariaDB.

Fix: update laravel/framework to 13.29.0 or newer (13.x), or 12.68.0 or newer (12.x).

Not listed as affected: Sanctum and…