Improper Authentication in Laravel Framework - #VU156199
Published: October 19, 2026
Vulnerability identifier: #VU156199
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and take over an arbitrary existing user account on routes protected by the affected guard.
The vulnerability exists due to improper authentication in Laravel's built-in TokenGuard when processing non-string credential values during authentication lookups. A remote attacker can submit a specially crafted, non-string credential value to make the underlying query match an unintended user record and authenticate without knowing that user's valid API token.
Affected software
Laravel Framework
Remediation
Install security update from vendor's website.
Laravel Framework - addressed in versions 12.68.0, 13.29.0