Repository navigation
[GHSA-f9x3-7vq9-cph6] Laravel TokenGuard authentication bypass through non-string API credentials - #10682
[GHSA-f9x3-7vq9-cph6] Laravel TokenGuard authentication bypass through non-string API credentials#10682rolandsusans wants to merge 2 commits into
Conversation
|
Hi there @andrei-laravel! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🟡 Changes recommended
The existing overlapping range still classifies patched Laravel 11 releases as vulnerable.
1 open issue
What changed in this PR
Updates the Laravel TokenGuard security advisory to document the Laravel 11 fix alongside the existing 12.x and 13.x fixes.
Changes:
- Adds an affected-version entry with
11.56.1as the fixed version. - Adds the Laravel 11.56.1 release reference and updates the modification timestamp.
| File | Description |
|---|---|
| advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json | Adds Laravel 11 affected-version data and a release reference. |
Review effort: Max
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" |
|
Hi there @andrei-laravel! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |

Updates
Comments
laravel/framework@v11.56.0...v11.56.1
It's actually fixed for v11 as well, seems like CVE needs to be updated.