Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard     token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB     configurations, the authentication lookup can match an unintended existing user, allowing an     unauthenticated attacker to bypass authentication and take over an account on routes protected by     TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0. (CVE-2026-114509)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard
    token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB
    configurations, the authentication lookup can match an unintended existing user, allowing an
    unauthenticated attacker to bypass authentication and take over an account on routes protected by
    TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0. (CVE-2026-114509)

ID	Name	Product	Family	Type	Severity
374562	Linux Distros Unpatched Vulnerability : CVE-2026-114509	Nessus	Misc.	Local	critical
477242	SCA: security update for laravel/framework (GHSA-f9x3-7vq9-cph6)	Tenable Cloud Security	SCA Checks	Local	critical
477242	SCA: security update for laravel/framework (GHSA-f9x3-7vq9-cph6)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-114509

critical

Tenable Plugins

critical

critical

critical