Erhan ÜRGÜN: “A critical security vulnerability (CVE-2026-114509) has been…”

Erhan ÜRGÜN @erhanurgunOct 31

A critical security vulnerability (CVE-2026-114509) has been identified in Laravel! This vulnerability allows an unauthenticated attacker to authenticate as another user without possessing that user’s API token! In certain MySQL/MariaDB configurations, unauthorized access to another user’s account can be gained through API endpoints protected by TokenGuard... Severity: Critical (CVSS v4.0: 9.2) This vulnerability has been fixed in Laravel versions 12.68.0 and 13.29.0... It is recommended that affected systems be updated! For details: - https://nvd.nist.gov/vuln/detail/CVE-2026-114509 - https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

nvd.nist.govNVD - Home

08:50 · Oct 31, 2026commit 658b7fc

Neo @neoighodaroOct 31

Saw this. I use pgsql so I assume no hurry to update

Suliman Benhalim @sulimanbenhalim6d

makes sense, mysql turns 'abc' = 0 into true while postgres just throws a type error 🙂 still a one line composer update tho

Commit