CVE-2026-39976: Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens
(updated )
Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there’s no user). The token guard then passes this value to retrieveById() without validating it’s actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user.
References
- github.com/advisories/GHSA-349c-2h2f-mxf6
- github.com/laravel/passport
- github.com/laravel/passport/issues/1900
- github.com/laravel/passport/pull/1901
- github.com/laravel/passport/pull/1902
- github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6
- github.com/thephpleague/oauth2-server/issues/1456
- nvd.nist.gov/vuln/detail/CVE-2026-39976
Code Behaviors & Features
Detect and mitigate CVE-2026-39976 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →