VulnSocial

CVE-2026-39976Disclosure(laravel / passport)

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

laravel CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • passport

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
laravel
Products
passport

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-09: 1Technical Details · 2026-04-09: 104-09
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • CVE@CVEnew
    Disclosure

    CVE-2026-39976 Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/… https://www.cve.org/CVERecord?id=CVE-2026-39976

    Post summary

    This post announces an authentication bypass vulnerability (CVE‑2026‑39976) in Laravel Passport versions 13.0.0 to 13.7.1 for client_credentials tokens, but no PoC, exploit, or patch details are provided.

    0000091
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applaravelpassport-laravel-

Explore more

Back to dashboardlaravel CVEspassport vulnerabilities