Laravel TokenGuard flaw CVE-2026-114509 allows account takeover without credentials

·4 views

A critical vulnerability tracked as CVE-2026-114509, rated 9.2 on CVSS v4, affects Laravel's built-in token API guard. Its advisory was published on 19 October 2026. The flaw lets an unauthenticated attacker sign in as an existing user, but only on apps using the token driver with MySQL or MariaDB. Sanctum, Passport, and session-based logins are not affected. The fix is to update laravel/framework to 12.68.0 or 13.29.0 or later, and Laravel 11.x has no fixed release named yet.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Researcher Finds High-Severity Rounding Flaw in Tenor Labs' Morpho Midnight Migration Logic

A security researcher participating in a bug bounty for Tenor Labs, a non-custodial protocol extending Morpho Midnight, identified a high-severity rounding vulnerability in its migration callbacks. The flaw stems from a rounding-down calculation that can transfer zero collateral when a tiny debt amount is repaid, leaving new debt unbacked. An attacker could exploit this by making a minimal fill on a migration offer, pushing a borrower's loan-to-value ratio to infinity and enabling liquidation of their existing collateral. The researcher published a Foundry proof of concept demonstrating the math behind the exploit.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why F# Breaks OpenAPI Routes: Sharp Symbols Clash With URL Fragment Rules

A developer building a music theory API found that entering F# as a root note in an OpenAPI interface produced a 404 error. The cause is that the # character marks a URL fragment, so the browser strips everything after it before the request reaches the server. Possible fixes such as percent-encoding, query parameters, or substituting letters were each judged to be awkward or musically misleading. The developer instead adopted German notation, which uses "is" for sharps and "es" for flats, such as Fis, so the URLs stay clean without special characters.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tracking Brand Visibility in Google AI Overviews Without a Paid API

Google AI Overviews now answer many commercial questions before users click any website, prompting businesses to ask whether they appear in these answers. Most AI visibility trackers charge per prompt and location through paid APIs, which is costly for small businesses. The author proposes a manual method: choose 10 to 20 real buying questions, run them weekly while signed out, and record whether an overview appears, whether the business is cited or mentioned, and which competitors are cited. To reduce the tedium of spreadsheets, the author's firm built a free browser-based tracker that stores data locally and computes visibility and share-of-voice scores. The article notes that cited businesses tend to answer target questions early on their pages, keep contact and service details consistent across the web, and receive mentions from other sites.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Details Migrating a Live Speaker Database from One-to-One to Many-to-Many

A developer describes building a speaker roles feature for an event platform, first shipped as a one-to-one relationship before requirements shifted to many-to-many. Existing events were live with integrations and API clients, so changes had to roll out without breaking anything. To keep compatibility, every event got an automatic default role, existing speakers were migrated to it, and the roleId field was made optional in the API. When a question arose about the legacy free-text custom field, production data showed it was sparsely used and too inconsistent to map reliably, so the author proposed an organizer-controlled toggle instead of an automatic migration.

0 comments Read more at DEV Community