psf-laravel-tokenguard-check(8)

Script: /opt/psf-security-patches/laravel/laravel-tokenguard-check.sh. Tool page: Laravel TokenGuard. Source. With the package installed: man psf-laravel-tokenguard-check.

Laravel TokenGuard authentication bypass: read-only checker  (v1)
CVE-2026-114509 (GHSA-f9x3-7vq9-cph6)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Laravel's built-in token guard ('driver' => 'token') does not reject a
crafted non-string credential, such as a JSON body {"api_token": [0]}. On
MySQL and MariaDB the lookup can then match an unintended existing user, so an
unauthenticated attacker can sign in as that user on any route protected by
the token guard. CVSS 9.2 (v4.0). Reported by Hristijan Manasijev.

Fixed in laravel/framework 12.68.0 and 13.29.0, both released 25 August 2026,
two months before the advisory was published on 19 October 2026. The 11.x
branch carries the same is_string() check from v11.56.1. 10.x and 9.x apps upgrade to a fixed branch. Apps that use
Laravel Sanctum or Laravel Passport register their own guard drivers and are
not the target of this bug.

This script is read-only. It looks at composer.lock and the installed
vendor/ copy, at config/auth.php for a guard with the token driver, at routes
that use that guard, and at the database driver in .env.

Usage:
  ./laravel-tokenguard-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /var/www /srv /home /opt) for Laravel
                   projects. Exit 0 = nothing exposed, 1 = an affected
                   project looks exposed or is on a branch that needs an upgrade.
  middleware       print a protective PHP middleware that rejects non-string
                   api_token values. It prints to stdout only.
  version          print the script version.

The protective middleware is for apps that cannot upgrade today. 9.x and 10.x apps should plan an upgrade.
Containers: with no directory argument the check also reads the project files it needs from
running docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them), through a
read-only probe, and judges them like host projects. The copies are temporary: a path shown as
.../docker_NAME/PATH is the PATH inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.