Laravel patches TokenGuard flaw that could allow account takeover
Laravel says certain MySQL and MariaDB configurations could let attackers sign in without a user’s valid API token. Releases 13.29.0 and 12.68.0 fix the flaw.
Loading… Բեռնվում է…
Laravel says certain MySQL and MariaDB configurations could let attackers sign in without a user’s valid API token. Releases 13.29.0 and 12.68.0 fix the flaw.
Laravel has patched a critical TokenGuard flaw that could allow an attacker to access an existing user’s account without that user’s valid API token, The Hacker News reported on October 22. Laravel says the risk arises under certain MySQL or MariaDB database configurations.
TokenGuard is Laravel’s built-in component for checking API tokens—credentials applications use to control access. The check should reject an invalid credential. In the affected configurations, Laravel says, it can instead match a different user’s database record.
Laravel says the problem occurs when the authentication lookup mishandles a specially crafted credential that is not a string, or text value. The database query can then select an unintended user record rather than reject the request.
That could let someone who has not signed in authenticate as another user, Laravel says. The resulting account-takeover risk applies to routes—application paths that handle requests—protected by the affected guard.
The vulnerability is tracked as CVE-2026-114509. For operators using affected TokenGuard configurations, Laravel releases 13.29.0 and 12.68.0 contain the fix.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min