Laravel patches a critical auth bypass in its token API guard
A crafted, non-string credential let an attacker log in as any user through TokenGuard on MySQL or MariaDB, no token required. Fixed in 13.29.0 and 12.68.0.
Laravel published a critical security advisory on 19 October for Illuminate\Auth\TokenGuard, the class behind any guard in config/auth.php set to the token driver. On MySQL or MariaDB, a specially crafted, non-string credential value caused the authentication lookup to match an unintended user record instead of rejecting it, letting an unauthenticated attacker log in as that user without knowing their API token.
The advisory, GHSA-f9x3-7vq9-cph6, rates it CVSS 9.2, critical, with no privileges or user interaction needed. Sanctum and Passport guards are unaffected, only the plain token driver. The fix, shipped in Laravel 13.29.0 and 12.68.0, adds a string check before the token reaches the query:
if (is_string($token) && ! empty($token))Reported by Hristijan Manasijev, no CVE has been assigned yet, but the GHSA ID is live on the framework’s own repository.
Why it matters: this sits in core Laravel, not a package, and it needs nothing from the attacker beyond a crafted request. Anyone with a token-driver guard on MySQL or MariaDB should run composer update laravel/framework to 13.29.0 or 12.68.0 now rather than treat this as routine dependency hygiene.
The caveat: the bug only affects the token guard driver specifically, not Sanctum or Passport, so check config/auth.php before assuming you’re exposed.