CVE-2026-39976 HIGH

CVE-2026-39976: Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

Vendor Laravel
Product passport
Weakness CWE-287 · Improper authentication
Published April 9, 2026
Last update April 9, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

Key dates

02Disclosure timeline

April 9, 2026 CVE published
April 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-11015 Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user CVE-2024-10114 Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider CVE-2024-11293 Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider CVE-2025-1475 WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone' CVE-2026-1305 Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation