Multiple vulnerabilities affecting the Laravel framework

Laravel is an open source web application development framework based on the PHP language, widely used for creating APIs and business applications. Vulnerabilities were discovered and made public on October 19, 2026 by security researcher Hristijan Manasijev (KIKOmanasijev). The first and most critical flaw affects the TokenGuard authentication component of applications using MySQL or MariaDB databases resulting from incorrect processing of authentication data during credential verification. An unauthenticated threat actor could impersonate another user and access their account without possessing their API token. The second flaw concerns the inclusion of relationships on read endpoints caused by a lack of validation and control in HTTP request processing. A malicious actor with simple read access could send a specially crafted request to cause irreversible data loss on affected systems.

• Bypassing authentication via TokenGuard;
• all Laravel versions before 12.68.0;
• Laravel versions 13.x prior to 13.29.0;
• Unauthorized destruction of data;
• Laravel 12.x versions between 12.45.0 (inclusive) and 12.68.0 (excluded);
• Laravel versions 13.x prior to 13.27.0;