Laravel published the advisories on October 20, 2026. The critical issue is in Illuminate\Auth\TokenGuard, which is used when config/auth.php defines a guard with the token driver and the users provider. On MySQL and MariaDB, an unauthenticated attacker could submit a crafted non-string credential. The authentication lookup could then match an unintended user instead of failing, enabling account takeover on routes protected by that guard.

terminal
composer update laravel/framework

The bypass is tracked as GHSA-f9x3-7vq9-cph6 and has a CVSS score of 9.2. Hristijan Manasijev reported it. Before the fix, the guard only checked that the supplied token was not empty. The patch adds an is_string($token) check in user() and validate(), rejecting arrays and other non-string values before the database query. The advisory covers the token driver only. Sanctum and Passport use their own guard drivers and are not listed as affected.

Manasijev reported a second issue published the same day. Under specific conditions, a crafted request to a read-only JSON:API endpoint could trigger a destructive operation on a related table. A user with read access could empty that table. The issue is tracked as GHSA-5wcm-3v2w-8362 and has a CVSS v3.1 score of 6.5, rated medium. It affects the JSON:API resources added in Laravel 12.45.0. Its fix changes how requested relationships are loaded.

The token-guard issue affects versions below 12.68.0 and below 13.29.0. The JSON:API issue affects 12.45.0 through versions below 12.68.0 and versions below 13.27.0. The fixes are Laravel 12.68.0 and 13.29.0 for the bypass, plus Laravel 12.68.0 and 13.27.0 for the JSON:API issue. Laravel released 12.68.0 and 13.29.0 on August 25, 2026. Applications updated since then contain both corrections. Patches are available only for the 12.x and 13.x branches.

Teams should update laravel/framework with composer update laravel/framework. They should inspect config/auth.php for token-driver guards, giving priority to applications that use MySQL or MariaDB, and run composer audit. Both advisories are listed on Laravel’s laravel/framework security page.