Laravel TokenGuard Bypass CVE-2026-114509, Livewire and Filament

I noticed a batch of security advisories for the Laravel ecosystem appearing on Packagist around 23 Oct. 2026, so I opened the GitHub advisory pages one by one instead of reading news reports, because several have specific conditions (you must use a particular feature, enable debug, or use a particular database), and reading just the headlines can easily lead to a wrong assessment. This note includes only those whose original advisories I have read in full, grouped by package.

The first one to check is the Critical TokenGuard issue in laravel/framework. Most of the others are Moderate to Low, and all have fixed releases available.

What happened

TokenGuard (CVE-2026-114509) is the main issue in this batch. If Laravel's standard token guard receives a specially crafted non-string credential from an attacker, some MySQL or MariaDB configurations mishandle that value during the user lookup. The query then matches another user's record, allowing an unauthenticated person to access the system as an existing user without knowing that user's API token, and reach every route protected by this guard. The advisory does not say which database configurations cause this, and the page does not mention Sanctum or Passport at all, so I will not guess which is affected or unaffected.

The other two issues in laravel/framework

• Relationship inclusion (CVE-2026-114508) On certain read endpoints, a specially crafted request triggers commands that delete data in related tables, even though the caller has only read access. The advisory warns that the lost data cannot be recovered, for example when an entire related table is wiped.
• Debug page XSS (CVE-2026-102279) Occurs only when APP_DEBUG=true. Attacker-controlled data ends up in a Tippy.js tooltip with allowHTML enabled and executes when the mouse hovers over it.

The individual issues in Livewire, Filament and the other libraries are smaller in scope; I have grouped them in the next section.

Severity

The TokenGuard vector is network-accessible, has low complexity, requires no privileges or user interaction, and has a High impact on all three areas: confidentiality, integrity and availability. Its EPSS is 0.777% (around the 56th percentile), which estimates the likelihood of exploitation rather than indicating that exploitation has occurred. None of the advisory pages I opened reported exploitation in the wild, and none of these entries appeared in the feed I used to check CISA KEV.

One date caveat: GitHub published the TokenGuard and relationship advisories on 19 Oct., but Packagist recorded them as 23 Oct., which is why they all appeared as news together that day. I use 23 Oct. as the main date, following Packagist.

Affected and fixed versions

The numbers below come from each advisory page.

TokenGuard's affected range says all versions "below 12.68.0," but the advisory I saw did not list fixed releases for branches before 12. If your app is still on an older branch, you need to move to 12 or later first.

Livewire #[Authorize] has 3 failure modes. Reordered parameter keys (for example, sending {"1": 2, "0": 1}) cause the authorization check to run against one record while the action operates on another; methods using both #[On] and #[Authorize] behave the same way; and #[Json] methods execute their code before checking authorization (they do return 403, but the database write has already happened). This affects only apps using this attribute. Apps that check authorization with $this->authorize(...) inside the method are unaffected.

Filament has 4 advisories in this batch, all related to MFA and the login page. The most severe is CVE-2026-77567 (High, 8.1), which allows the MFA step to be bypassed when recovery codes are enabled. The others allow an old authenticator app code to be reused for around 4 minutes by default if the attacker already has the password and one code, let the login page confirm whether a password is correct for an account barred from the panel, and allow MFA management actions without requiring password re-entry. None affect email-based MFA, and there is no workaround. Updating to 4.13.3 or 5.8.3 covers the full set.

league/commonmark has 12 advisories from 6 Aug. to 30 Sep., mostly denial of service (CPU exhaustion while parsing specially crafted Markdown), but two XSS issues are more significant. One bypasses the AttributesExtension on* filter with a form feed character (2.7.0 to before 2.9.1); the other allows <script through DisallowedRawHtml when the tag name is at the end of a line (1.3.0 through 2.10.1). Both affect apps that render Markdown from untrusted users. The mitigation for the latter is to set html_input to escape or strip, and for the former to define an explicit attributes.allow list. As for fixed releases, I read only 3 pages in full (2.9.1 and 2.10.2); for the rest, I worked from the affected ranges, all of which end at 2.10.1 or earlier, so 2.10.2 is clear of all of them.

Symfony HeaderUtils::split() consumes CPU exponentially when a Cache-Control header contains a long run of spaces (around 813 milliseconds per request with 17 spaces on PHP 8.5, doubling with each additional space). Anyone sending HTTP requests through Symfony can reach it without logging in. Versions 6.4.46, 7.4.19 and 8.1.7 were the first fixes, but they had a regression involving split('foo bar', ' '), so use 6.4.48, 7.4.21 or 8.1.9 instead. Symfony's page was published on 15 Oct., while the Packagist feed recorded 15 Sep., and the GitHub Advisory Database published GHSA-r925-mgvr-h9cc on 27 Oct. with a High rating (CVSS v4 8.7). The three sources disagree on the date; I use the date on Symfony's page as the original source. Symfony's own page does not provide a CVSS score.

phpseclib (CVE-2026-84308) requires several conditions at once: the same X25519 key must be reused over a long period, the pure-PHP path must be active (without ext-sodium), and the attacker must be able to take precise timing measurements at the same-machine level. The author calls it a hardening issue rather than a complete remote exploit, so it comes last in priority.

How to fix it

1. Check the installed versions in the project repo, not just on the dev machine
2. Run composer audit to see what Composer finds in the advisory database
3. Update all six packages together along with their related dependencies
4. Restart workers, queue, Octane and PHP-FPM so they use the new code
5. Test routes using the token guard and Livewire actions using #[Authorize] before the full rollout

# ดูรุ่นของทั้งหกตัวที่ลงอยู่ในโปรเจกต์
composer show | grep -E '^(laravel/framework|livewire/livewire|filament/filament|league/commonmark|symfony/http-foundation|phpseclib/phpseclib) '

# เทียบกับฐานข้อมูล advisory (ใช้ --locked ใน CI ได้)
composer audit

composer update laravel/framework livewire/livewire filament/filament \
  league/commonmark symfony/http-foundation phpseclib/phpseclib --with-dependencies

composer audit
php artisan optimize:clear
php artisan queue:restart

If composer.json pins a version range narrower than the fixed release (such as ~12.40.0), the commands above will not move it forward; adjust the constraint first. For apps using Filament, also check that the installed Filament plugins still support the new version; otherwise, composer update will report the conflict.

For debug, check every environment exposed to the internet.

php artisan about --only=environment
grep -n '^APP_DEBUG' .env

As a general rule, production should already use APP_DEBUG=false, but CVE-2026-102279 is a reminder that the debug page is an attack surface in its own right, not just a source of information leaks.

Check whether you have been affected

None of these advisories publishes indicators of compromise, so I only have guidance inferred from the vulnerability descriptions, rather than a list from the original sources.

For TokenGuard, I infer that an actual attacker would send the token value as an array or object instead of plain text. Try reviewing access logs for API routes and looking for array-style parameters.

grep -E 'api_token(\[|%5B)' /path/to/access.log | head

This command sees only query strings; if the token is sent in a JSON body or header, it will not appear in normal logs. The remaining checks are for effects at the application end, such as a single user having sessions or API calls from unusual IPs in quick succession, unexpected data loss in tables related to read endpoints (CVE-2026-114508), or changes to a Filament account's MFA that its owner did not make. If you have a recent database backup, preserve it before updating, because data deleted by the latter issue can only be recovered from a backup.

My view is that if an app exposes routes using the token guard to the internet, Laravel should get an urgent update outside the normal schedule, because authentication can be bypassed across the system and the fix is a version update. Filament installations with MFA enabled should be handled in the same round. The rest (commonmark, Symfony, phpseclib, Livewire 3) can go into the normal maintenance cycle, depending on each app's risk and whether it accepts Markdown from outsiders. You can compare all the version ranges and conditions above directly against each project's composer.lock.

P.S. For my earlier Laravel article on checking the security of a deployed app, see Laravel security audit.

Sources: GitHub Advisory Database (github.com/advisories/GHSA-f9x3-7vq9-cph6, GHSA-5wcm-3v2w-8362, GHSA-jh5r-qr3c-85q8, GHSA-mhf7-xp6r-6qrc, GHSA-g3hc-697w-wm82, GHSA-52xp-w8hr-xv3c, GHSA-r3j6-gpjw-qfjr, GHSA-xwpv-pqxp-5v36, GHSA-7m6h-rg42-m449, GHSA-3q6v-r5mr-hxv8, GHSA-97jj-33gv-5xf9, GHSA-f8fg-pg57-v4j8, GHSA-q97c-8qh3-fpc6), Packagist Security Advisories API (packagist.org/api/security-advisories), Symfony (symfony.com/cve-2026-108082). Information current as of 5 Nov. 2026. If more advisories appear or fixed releases change, I will come back and update this article.