Laravel discloses critical TokenGuard account takeover flaw and a separate data-loss bug

Laravel published GHSA-f9x3-7vq9-cph6 on 19 October 2026 with a 9.2 critical rating for an authentication bypass in Illuminate\Auth\TokenGuard. With a token-based API guard and certain MySQL/MariaDB configurations, a specially crafted non-string credential can cause a database lookup to match an unintended user. An unauthenticated attacker can thereby impersonate another user on protected routes. A second advisory, GHSA-5wcm-3v2w-8362, rates 6.5 and describes a JSON:API relationship-inclusion path that can turn a read request into a destructive operation on related data. Laravel 12.68.0 and 13.29.0 already contain both fixes, released 25 August 2026; the public advisories arrived later.

This is an operationally urgent distinction between application framework version and actual authentication configuration. Teams with older Laravel installations using the built-in token driver on MySQL/MariaDB may have an account-takeover exposure even without leaked tokens. The second issue illustrates how a read-only API permission does not guarantee no database writes when relationship-loading code has a defect. Updating and verifying route guards is more useful than assuming every Laravel authentication package shares the same vulnerability.

The primary advisory concerns the built-in token guard (a guard with driver 'token' in config/auth.php) and certain MySQL/MariaDB configurations. A non-string credential reaches a lookup that may resolve an unintended user. The advisory does not list Sanctum or Passport as affected by this TokenGuard issue; applications must inspect their actual guards rather than infer exposure from the Laravel brand alone.

Laravel News traces the TokenGuard fix to an is_string() condition in both user() and validate(). Rejecting arrays and other non-text inputs prevents the dangerous database comparison. Operators should upgrade laravel/framework to at least 12.68.0 on the 12.x line or 13.29.0 on 13.x, then confirm the deployed lockfile and runtime.

GHSA-5wcm-3v2w-8362 concerns relationship inclusion on certain read endpoints introduced in the 12.45.0 era. Under specified conditions a read request can trigger a destructive operation against a related table. The advisory identifies fixed versions 12.68.0 and 13.27.0; using 13.29.0 or newer covers both advisories. The public description does not establish that every read endpoint is affected.

Both fixes were shipped on 25 August but advisories were published on 19 October. Teams with current patch versions may already be protected. For older or pinned applications, check config/auth.php and composer.lock, update the package, and exercise authentication and JSON:API regression tests on staging before production rollout.