CVE-2026-39976CWE-287

Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

High · published April 9, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-04-09T16:50Z
EPSS history
Timeline
  • 09 APR 16:50Z
    Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens
    cvelistv5