CVE-2026-39976
High
Description
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Laravel Passport
PublishedApr 9, 2026
First seenApr 9, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- laravel passport13.7.1 or later
- laravel/passport13.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| laravel passport | 13.0.0 ≤ v < 13.7.1 | 13.7.1 |
| laravel/passportPackagist | 13.0.0 ≤ v < 13.7.1 | 13.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.