Laravel: security advisory

Laravel

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential.

Do this now

Upgrade Laravel to 12.68.0 or 13.29.0 or later and review TokenGuard API access logs.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 19:19 UTC
Identifiers: CVE-2026-114509
CVSS: 9.2
Source: news
On the menu as: PHP

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Laravel: security advisory
Severity: critical. Patch status: fix status unknown.
Affected: Laravel
Ids: CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential.

## Steps
1. Search the repo, its CI and infra config for Laravel. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-114509") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5 https://nvd.nist.gov/vuln/detail/CVE-2026-114509
https://pwned.coffee/i/laravel-is-a-web-application-framework-cve-2026-114509

Timeline

23 Oct 2026, 19:20 UTC
Proof-of-concept code for CVE-2026-114509 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee