ThreatsDay: Bluesky phishing, Laravel bypass, NVIDIA AIStore flaw
Bluesky suspended over 4,500 phished accounts; Laravel 12.68.0 and 13.29.0 fix CVE-2026-114509, and Roundcube shipped 20 fixes.
58
VulnerabilityPoC ×5
CVE-2026-114509
Unauthenticated auth bypass in Laravel TokenGuard before 12.68.0/13.29.0
- CVSS 4.0
- 9.2 critical
- EPSS
- <1%p33
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Laravel TokenGuard, when used as a standard token-based API guard, does not reject a crafted non-string credential. An unauthenticated network attacker can send that credential so that, under affected MySQL or MariaDB settings, the lookup matches an unintended existing user and takes over that account on TokenGuard-protected routes. Apps on Laravel before 12.68.0 or 13.29.0 with those database settings are affected. Public proof-of-concept code exists.
What to do: Upgrade Laravel to 12.68.0 or 13.29.0. No workaround is named.
| Product | Affected | Fixed in |
|---|---|---|
| Laravel | prior to 12.68.0 and 13.29.0 | 12.68.0 and 13.29.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.
- Ecosystems
- composer
- Weakness
- CWE-287, CWE-1287
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- GHSA
- GHSA-f9x3-7vq9-cph6 (critical)