🔧 Root cause: the guard only checked that the token was not empty. The fix adds an is_string() check to both user() and validate(), so arrays and other non-string values are rejected before any database query runs
🎯 Affected: apps with a guard using 'driver' => 'token' in config/auth.php. #Sanctum and #Passport register their own guard drivers and are not listed in the advisory (GHSA-f9x3-7vq9-cph6). Reported by Hristijan Manasijev