CVE-2026-114509: framework < 12.68.0, >= 13.0.0, < 13.29.0

Affected technology

framework · < 12.68.0, >= 13.0.0, < 13.29.0
laravel

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality, integrity and availability impact as high.