In case you missed that
https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
GitHubToken-based API guard Auth BypassLaravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. ...
commit 937ad43