CVE-2026-39976
HIGH EPSS 20.6%
Published Apr 9, 20262mo ago · Modified Jun 17, 20262w ago
7.1 CVSS 3.1
Published Apr 9, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
20.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-287 Improper Authentication Authentication
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| laravel | passport | * | ≥13.0.0 – <13.7.1 |
References 5
- github.com https://github.com/laravel/passport/issues/1900
- github.com https://github.com/laravel/passport/pull/1901
- github.com https://github.com/laravel/passport/pull/1902
- github.com https://github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6
- github.com https://github.com/thephpleague/oauth2-server/issues/1456#issuecomment-2734989996
Remediation
- github.com https://github.com/laravel/passport/pull/1901
- github.com https://github.com/laravel/passport/pull/1902
- github.com https://github.com/thephpleague/oauth2-server/issues/1456#issuecomment-2734989996