Critical Laravel Security Fix: Token Guard Auth Bypass (Update to 12.68 / 13.29 Now)

If you run a Laravel application, set aside ten minutes today. Laravel has released security updates for a critical authentication bypass in its built-in token guard. On MySQL and MariaDB, the flaw let an attacker sign in as a real user without knowing that user's API token.

The fix is a single Composer command. Here's what happened, how to tell whether you're affected, and what to do.

In short

• What: Authentication bypass in Laravel's token guard (CVSS 9.2, critical)
• Who: Apps that use the token guard driver, especially on MySQL or MariaDB
• Fix: Upgrade to Laravel 12.68.0 or 13.29.0 (or later)

What went wrong?

Laravel ships with a simple API authentication driver called the token guard (Illuminate\Auth\TokenGuard). It reads an API token from the request and looks up the user it belongs to.

Before the patch, the guard only checked that the token wasn't empty. It never checked that the token was actually a string. An attacker could therefore send a specially crafted non-string value, such as an array, as the "token". On MySQL and MariaDB, the database lookup handled that value badly and could match an existing user's record instead of failing.

The result: anyone who could reach a route protected by the token guard could potentially take over user accounts.

The issue was reported by security researcher Hristijan Manasijev and is tracked as advisory GHSA-f9x3-7vq9-cph6.

The fix: one small check

The patch is short. Laravel now confirms the token is a string before it reaches the database, in both the guard's user() and validate() methods:

if (is_string($token) && ! empty($token)) {
    // only now is the token used to look up a user
}

Arrays and other unexpected types are now rejected immediately. This is a good lesson for any codebase: never assume request input has the type you expect. Validate it before it reaches a query.

Am I affected?

Open config/auth.php and look at your guards. If you see something like this, you are using the affected driver:

'guards' => [
    'api' => [
        'driver'   => 'token',
        'provider' => 'users',
    ],
],

Sanctum and Passport register their own guard drivers, so they are not part of this advisory. Every Laravel version below 12.68.0 is listed as affected, though, so upgrading is a good idea either way.

A second fix in the same release

The same researcher reported a medium-severity issue (CVSS 6.5) in Laravel's JSON:API resources. A request to a read-only endpoint could be crafted to trigger a destructive database operation on a related table. In other words, a user with only read access could empty a related table.

It affects Laravel 12.45.0 up to 12.68.0 and versions below 13.27.0. It is fixed in 12.68.0 and 13.27.0 (advisory GHSA-5wcm-3v2w-8362).

Affected and fixed versions

Patches are only available for the 12.x and 13.x branches. If you are on Laravel 11 or older, plan your upgrade now.

What to do now: 3 steps

1. Update the framework

composer update laravel/framework

Then confirm the installed version is 12.68.0 or 13.29.0 or later:

php artisan --version

2. Review your guards

Check config/auth.php for any guard using the token driver. Apps on MySQL or MariaDB come first.

3. Audit your dependencies

Composer can compare your packages against published security advisories:

composer audit

Tip: If you used the token guard on a public API, review your logs for unusual logins or account activity from before you patched.

Final thoughts

The fix itself is one line, but the impact of the bug was serious: full account takeover with no token required. Keeping your framework up to date is one of the cheapest and most effective security habits you can build. Run composer update, check your guards, and move on with confidence.

Found this useful? Share it with a fellow Laravel developer, and follow the blog for more practical web development and security updates.

Sources and further reading

• Laravel News: Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68 (cover image: Laravel News)
• GitHub advisory GHSA-f9x3-7vq9-cph6 (token guard)
• GitHub advisory GHSA-5wcm-3v2w-8362 (JSON:API)
• The fix commit on GitHub