Authentication Bypass Vulnerability in Laravel Passport OAuth2 Server

CVE-2026-39976

What is CVE-2026-39976?

An authentication bypass vulnerability has been identified in the Laravel Passport package, affecting OAuth2 tokens generated from versions 13.0.0 to prior to 13.7.1. This issue arises from the way that the league/oauth2-server library sets the JWT subject claim to the client identifier. Consequently, when the token guard retrieves this value without proper validation of a legitimate user identifier, it can unintentionally authenticate machine-to-machine tokens as actual users. This flaw poses a significant security risk, allowing unauthorized access to user accounts. The vulnerability has been addressed in Laravel Passport version 13.7.1.

References