PT-2026-31663 · Taylor Otwell+1 · Laravel Passport+1

Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-39976

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Laravel Passport versions 13.0.0 through 13.7.0

Description Laravel Passport, which provides OAuth2 server support to Laravel, contains an authentication bypass issue for client credentials tokens. The league/oauth2-server library sets the JWT sub claim to the client identifier. The token guard then uses this value with the retrieveById() function without verifying it corresponds to a user identifier, potentially authenticating as an actual user. This allows any machine-to-machine token to authenticate as a user.

Recommendations Update to Laravel Passport version 13.7.1 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-05283

CVE-2026-39976

GHSA-349C-2H2F-MXF6

Affected Products

Laravel Passport

League/Oauth2-Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-39976 · Security Note
• https://osv.dev/vulnerability/GHSA-349c-2h2f-mxf6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05283 · Security Note
• https://github.com/thephpleague/oauth2-server/issues/1456#issuecomment-2734989996 · Note
• https://github.com/laravel/passport · Note
• https://github.com/laravel/passport/issues/1900 · Note
• https://github.com/laravel/passport/pull/1902 · Note
• https://github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6 · Note
• https://github.com/laravel/passport/pull/1901 · Note
• https://vuldb.com/ru/vuln/356633 · Note
• https://twitter.com/CVEnew/status/2042302789616091390 · Twitter Post