Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68

Laravel has published a critical security advisory for its token-based API guard. On MySQL and MariaDB, an unauthenticated attacker could authenticate as an existing user without knowing that user's API token. Hristijan Manasijev reported the issue, and the fix is in Laravel 12.68.0 and 13.29.0.

This is a critical advisory (GHSA-f9x3-7vq9-cph6), having a Common Vulnerability Scoring System (CVSS) score of 9.2. You should upgrade as soon as possible.

Manasijev announced the auth bypass on X:

I found a CRITICAL auth bypass in Laravel 🚨 (9.2/10)

On MySQL/MariaDB, Laravel's token API guard let an unauthenticated attacker log in as an existing victim user.

Patched in 12.68.0 & 13.29.0.

Manasijev also reported a second issue, published the same day, that let a read-only request delete data through JSON:API resources.

#What Happened

The bug is in Illuminate\Auth\TokenGuard, the class behind the token guard driver. Your app uses it if a guard in config/auth.php looks like this:

'guards' => [
    'api' => [
        'driver' => 'token',
        'provider' => 'users',
    ],
],

From the advisory:

Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.

An attacker who used this could take over any account on routes protected by the guard. The advisory covers the token driver only. Sanctum and Passport register their own guard drivers and are not listed in it.

#How It Was Fixed

Before the fix, the guard checked only that the token from the request was not empty before it passed the token to the user provider. The fix adds an is_string() check to both user() and validate(). The guard now rejects arrays and other non-string values before it queries the database:

if (is_string($token) && ! empty($token)) {

#JSON:API Resource Data Destruction

The second advisory, GHSA-5wcm-3v2w-8362, has a CVSS v3.1 score of 6.5 (medium). It affects the JSON:API resources added in Laravel 12.45. From the advisory:

Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

A user with only read access could empty a related table. The fix changes how JSON:API resources load the relationships a request asks to include.

#Affected Versions

Laravel 12.68.0 and 13.29.0 were both released on August 25, 2026, so apps updated since then already have both fixes. The auth bypass advisory lists every version below 12.68.0 as affected, and patches exist only for the 12.x and 13.x branches.

#What You Should Do

• Update laravel/framework to 12.68.0 or 13.29.0 or later with composer update laravel/framework
• Check config/auth.php for any guard that uses the token driver, and treat those apps as the priority if they run on MySQL or MariaDB
• Run composer audit to compare your installed packages against published advisories

Both advisories are on the laravel/framework security page.