Security notice

Is your site or store built on Laravel? A stranger could log in as your users.

Last updated: Thursday, October 22, 2026, 2:44 PM ETStatus: Fix released. Attack code is public. No attacks reported yet.

Laravel, a popular framework for building websites, online stores and customer portals, published a critical security advisory on October 19, 2026. The flaw, CVE-2026-114509, is rated 9.2 out of 10. Laravel says that on apps using its built in "token" login guard with a MySQL or MariaDB database, an attacker with no account could log in as an existing user without that user's password or API token. Researchers published working attack code the next day. The fix has been out since August 25, so if your developer updated Laravel since then you are likely already covered. If your site, store or app runs on Laravel, ask your developer today.

What happened

The flaw. Laravel says its built in TokenGuard can be bypassed "to authenticate as an arbitrary existing user without knowledge of their valid API token." It happens when an attacker sends a specially crafted value that a MySQL or MariaDB database mishandles, so the login check matches a real user instead of failing. (Laravel advisory, CVE record)
What is at stake. Laravel says an unauthenticated attacker could take over accounts on any part of the app protected by that guard. Depending on the app, that could mean customer accounts, orders, staff tools or data behind your API. (Laravel advisory)
The timeline. Laravel shipped the fix in versions 12.68.0 and 13.29.0 on August 25, 2026, and published the advisory on October 19. (Laravel News, Laravel advisory)
Attack code is public. On October 20, Yokai Research at Hakai Security published a detailed analysis and a working proof of concept exploit. (Yokai Research)
No attacks reported yet. None of the sources we checked report attacks using this flaw as of October 22, 2026. With working attack code public, that can change fast.

Who should worry

Ask about this if your website, online store, booking system, customer portal or mobile app backend was built with Laravel. You are most at risk if all of these are true:

It uses Laravel's "token" guard for logins, usually an API guard in config/auth.php with 'driver' => 'token'.
Its user accounts are stored in MySQL or MariaDB.
Laravel has not been updated since August 25, 2026.

Laravel News says Laravel Sanctum and Passport use their own login drivers and are not listed in the advisory. (Laravel News) If your site runs on WordPress, Shopify, Squarespace or Wix, this flaw is not about your site, unless a developer built you a separate Laravel app.

What to do now

Do these today.

Ask the question. Send the message below to your developer or agency. You need a clear answer: is anything we run built on Laravel, and is it on 12.68.0 or 13.29.0 or later?
Update. Laravel's fix is in 12.68.0 and 13.29.0. Update every Laravel app you run, including staging and test copies.
Older versions. Laravel's advisory lists every version below 12.68.0 as affected and names fixes only for 12.x and 13.x. Yokai Research says the same fix also shipped in 11.56.1. If you run 10.x or older, do not assume you are covered: plan a move to a supported version now. (Laravel advisory, Laravel News, Yokai Research)
If the answer is "I don't know", that is not a no. Ask them to check using the steps below.

What to send your developer, agency or host

Laravel published advisory GHSA-f9x3-7vq9-cph6 (CVE-2026-114509, CVSS 9.2) on October 19, 2026. Laravel says an unauthenticated attacker could log in as an existing user on apps that use the built in "token" guard with MySQL or MariaDB. A public proof of concept was released on October 20. Please confirm whether any website, store, portal or API you run for us is built on Laravel, whether it uses the token guard, and which version of laravel/framework it runs. Please update each one to 12.68.0 or 13.29.0 or later today, including staging and test copies, and check recent API logs for login attempts that send the token as something other than plain text. Sources: Laravel advisory, Laravel News.

Technical steps

Step 1. Check your version

composer show laravel/framework

You are fixed on 12.68.0 or later on 12.x, or 13.29.0 or later on 13.x. composer audit also checks installed packages against published advisories. (Laravel News)

Step 2. Check whether you use the token guard

Look in config/auth.php for any guard with 'driver' => 'token'. Apps that use it with MySQL or MariaDB are the priority. (Laravel News)

Step 3. Update

composer update laravel/framework

Then deploy and confirm the new version is live. The fix makes the guard reject any token that is not a plain text string before it reaches the database. (Laravel News)

Step 4. Look for attempts

Yokai Research says its exploit sends the token as a list inside a JSON request body rather than as text. Review API logs for requests where the token field is not a normal string, and check for unexpected logins or account changes. (Yokai Research)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. None of the sources we checked report attacks using this flaw as of October 22, 2026. Attack code is public, though, so update now rather than wait.

Can EverThread tell me if I am affected?

No. EverThread checks websites from the outside, the way a browser sees them. We cannot see which Laravel version your app runs, how its logins are set up or what database it uses, and we do not test for this flaw. Your developer can check that in a few minutes. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

We updated Laravel in September. Are we safe?

Probably, if that update brought you to 12.68.0 or 13.29.0 or later. Ask your developer to confirm the exact version. (Laravel News)

We use Laravel Sanctum or Passport. Do we need to do anything?

Laravel News says Sanctum and Passport are not listed in the advisory. It is still worth checking that no other guard in config/auth.php uses the token driver, and updating anyway. (Laravel News)

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Laravel: Token-based API guard Auth Bypass, GHSA-f9x3-7vq9-cph6, October 19, 2026
CVE record: CVE-2026-114509
Laravel News: Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68, October 20, 2026
Yokai Research (Hakai Security): GHSA-f9x3-7vq9-cph6: Authentication Bypass in Laravel TokenGuard, October 20, 2026