CVE-2026-39976: Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39976?
CVE-2026-39976 is classified as a critical vulnerability due to its potential for authentication bypass allowing unauthorized access.
How do I fix CVE-2026-39976?
To mitigate CVE-2026-39976, upgrade Laravel Passport to version 13.7.1 or later immediately.
What are the affected versions in CVE-2026-39976?
CVE-2026-39976 affects Laravel Passport versions from 13.0.0 to before 13.7.1.
What type of vulnerability is CVE-2026-39976?
CVE-2026-39976 is an authentication bypass vulnerability related to client credentials tokens.
Who is affected by CVE-2026-39976?
Users of Laravel Passport who are utilizing versions 13.0.0 to less than 13.7.1 are affected by CVE-2026-39976.