GHSA-349c-2h2f-mxf6: Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens

April 8, 2026

Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there’s no user). The token guard then passes this value to retrieveById() without validating it’s actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user.

References

github.com/advisories/GHSA-349c-2h2f-mxf6
github.com/laravel/passport
github.com/laravel/passport/issues/1900
github.com/laravel/passport/pull/1901
github.com/laravel/passport/pull/1902
github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6
github.com/thephpleague/oauth2-server/issues/1456

Code Behaviors & Features

Detect and mitigate GHSA-349c-2h2f-mxf6 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →