Vulnerability DatabaseWS-2026-0147
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
WS-2026-0147
Published:October 19, 2026
Updated:October 22, 2026
laravel/framework v5.2.0-beta1 - v11.56.0, v12.0.0 - v12.67.0, v13.0.0 - v13.26.1 (and illuminate/auth v5.2.0 - v11.51.0, v12.0.0 - v12.67.0, v13.0.0 - v13.27.0): TokenGuard passes non-string api_token values (arrays or JSON scalars) to the user provider lookup, so on MySQL/MariaDB type juggling matches an arbitrary user and an unauthenticated attacker can log in as that user without a valid token (GHSA-f9x3-7vq9-cph6)
Affected Packages
https://github.com/laravel/framework.git (GITHUB):
Affected version(s) >=v13.0.0 <v13.27.0
Fix Suggestion:
Update to version v13.27.0
https://github.com/laravel/framework.git (GITHUB):
Affected version(s) >=v12.0.0 <v12.68.0
Fix Suggestion:
Update to version v12.68.0
https://github.com/laravel/framework.git (GITHUB):
Affected version(s) >=v11.0.0 <v11.56.1
Fix Suggestion:
Update to version v11.56.1
laravel/framework (PHP):
Affected version(s) >=v12.0.0 <v12.68.0
Fix Suggestion:
Update to version v12.68.0
illuminate/auth (PHP):
Affected version(s) >=v13.0.0 <v13.29.0
Fix Suggestion:
Update to version v13.29.0
illuminate/auth (PHP):
Affected version(s) >=v12.0.0 <v12.68.0
Fix Suggestion:
Update to version v12.68.0
laravel/framework (PHP):
Affected version(s) >=v11.0.0 <v11.56.1
Fix Suggestion:
Update to version v11.56.1
laravel/framework (PHP):
Affected version(s) >=v13.0.0 <v13.27.0
Fix Suggestion:
Update to version v13.27.0
Related Resources (4)
https://github.com/laravel/framework/commit/5056ca53797eed9244749695c3bb3f015a38415c
https://github.com/laravel/framework/commit/9b21ce0a9bb2b2599978bc0b0df4abea952ad31c
https://github.com/laravel/framework/commit/8dbb08bccac1be095dba4a9d259a419620f1e8a5
https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.2
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Validation of Specified Type of Input
CWE-1287