Laravel’s TokenGuard can be bypassed when a non-string credential is supplied; the guard fails to reject the malformed input and the underlying authentication lookup treats the value as a legitimate user identifier. This flaw allows an attacker who can send such a crafted credential to API routes protected by TokenGuard to authenticate without knowing a valid API token and to take over an existing user account.

The vulnerability exists in Laravel framework versions prior to 12.68.0 and 13.29.0 when the application uses a MySQL or MariaDB database. Any deployment of Laravel that has TokenGuard configured for standard token-based API authentication and that has not applied the recommended patch is affected.

The flaw has a CVSS score of 9.2, indicating a high severity. The EPSS score of 2% indicates a low probability of exploitation, but the lack of strict input validation and the ability to match unintended records mean that exploitation is straightforward for an attacker who can craft the request, making the risk of a successful attack significant. The issue is not listed in the CISA KEV catalog at this time, but its high impact and the nature of the flaw warrant immediate remediation.