LARAVEL has disclosed two security advisories on 19 October 2026, including a high-severity authentication bypass in TokenGuard that could enable account takeover without any login or valid token. The flaw, rated CVSS 9.2, allows an unauthenticated attacker to authenticate as another user on apps using the affected TokenGuard, effectively exposing any route protected by that guard.
A second, lower-severity advisory (CVSS 6.5) describes a read-endpoint misconfiguration that could trigger destructive database operations on related tables for users with read access, potentially causing irreversible data loss.
Exploitation status and affected versions are clearly outlined. The TokenGuard bypass affects laravel/framework versions prior to 12.68.0, and 13.x prior to 13.29.0. The related data-destruction advisory impacts 12.x from 12.45.0 up to 12.68.0, and 13.x prior to 13.27.0. There are no CVE IDs yet, and no confirmed public exploitation or PoC reported. Laravel instructs users to patch by upgrading to Laravel 13.29.0 (or 12.68.0 on the 12.x branch).
Additional mitigations include reviewing logs for unusual token-protected API logins and backing up databases behind read endpoints that load relationships. Given that the authentication bypass requires no credentials, priority should be given to applying the patch on MySQL or MariaDB deployments.