TypeError in SessionGuard::userFromRecaller() when remember-me cookie is stale (v12.69.0) #61396

Laravel Version

12.69.0

PHP Version

8.3.30

Database Driver & Version

MySQL 8

Description

After upgrading to Laravel v12.69.0, any request that calls Auth::check() / Auth::user() while a stale remember-me cookie is present throws:

TypeError: hash_equals(): Argument #1 ($known_string) must be of type string, null given

This started with #61386 (Ensure password hash matches stored cookie before authenticating the user).

When retrieveByToken() returns null (token rotated, user deleted, mismatched cookie, etc.), the new code still calls hash_equals():

$this->viaRemember = ! is_null($user = $this->provider->retrieveByToken(
    $recaller->id(), $recaller->token()
));

$userPassword = $this->viaRemember ? $user->getAuthPassword() : null;
$recallerHash = $recaller->hash();

return (hash_equals($this->hashPasswordForCookie($userPassword), $recallerHash)
        || hash_equals($userPassword, $recallerHash))
    ? $user : null;

Steps To Reproduce

1. Install Laravel 12.69.0 with session auth (Auth::attempt($credentials, remember: true) or Auth::login($user, true)).
2. Log in so the remember_web_* cookie is set.
3. In the database, change that user's remember_token to a different value (do not log out in the browser).
4. Delete only the session cookie (laravel_session). Leave remember_web_*.
5. Visit any route that calls Auth::check() (including /).

Result: TypeError from Illuminate\Auth\SessionGuard::userFromRecaller().

On 12.68.0 the same steps only result in a guest user.