Act today if this applies to you CVE-2026-114509 is a critical (CVSS 9.2) flaw in Laravel’s built-in token API guard. If your app authenticates API requests with the "token" driver and stores users in MySQL or MariaDB, an attacker with no account can sign in as an existing user, without that user’s token. Update laravel/framework to 12.68.0 or 13.29.0 or later. Apps that use only Sanctum, Passport or session logins are not affected by this flaw. 9.2 - CVSS v4 base score, rated crit...