What is the CVSS score of CVE-2026-39976?

CVE-2026-39976 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Passport are affected by CVE-2026-39976?

Laravel Passport versions 13.0.0-13.7.0 contain an authentication bypass flaw in machine-to-machine OAuth2 flows that allows any authenticated API client to impersonate arbitrary application users…. A patch is available.

How to fix or mitigate CVE-2026-39976?

Within 24 hours: Inventory all Laravel Passport deployments and identify which use client_credentials OAuth2 flows; audit M2M token distribution and access logs for suspicious impersonation patterns. Within 7 days: Implement runtime validation in custom token guard to verify that JWT sub claim matches an actual user before token acceptance; consider rate-limiting or monitoring M2M token usage for anomalous user impersonation attempts. Within 30 days: Monitor Laravel Passport security advisories and apply vendor patch immediately upon release; conduct access review of all M2M token holders and revoke unnecessary credentials.

Passport CVE-2026-39976

EUVD-2026-20970 HIGH

Improper Authentication (CWE-287)

2026-04-09 GitHub_M

GHSA-349c-2h2f-mxf6

Authentication Bypass Passport

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 17:15 euvd

EUVD-2026-20970

Analysis Generated

Apr 09, 2026 - 17:15 vuln.today

CVE Published

Apr 09, 2026 - 16:50 nvd

HIGH 7.1

DescriptionGitHub Advisory

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

AnalysisAI

Authentication bypass in Laravel Passport 13.0.0-13.7.0 allows machine-to-machine OAuth2 client_credentials tokens to impersonate arbitrary application users. The league/oauth2-server library sets JWT sub claim to client identifier for M2M flows; Passport's token guard fails to validate this identifier represents an actual user before passing to retrieveById(), enabling any M2M token to authenticate as unrelated real users. Affects all deployments using client_credentials grant type. Requires low-privilege authenticated access (PR:L). No public exploit identified at time of analysis.

Technical ContextAI

Root cause: missing user identifier validation in token guard chain. oauth2-server populates sub with client_id per spec; Passport guard invokes retrieveById(sub) without type checking, causing resolution against user table instead of client table (CWE-287). Cross-scope confusion between client and user identity domains enables privilege escalation from M2M context to user session.

RemediationAI

Vendor-released patch: upgrade to Laravel Passport 13.7.1 immediately. Fixed versions implement sub claim validation to prevent client identifier resolution against user models. Upstream fixes available via PR #1901 and PR #1902 per GitHub advisory GHSA-349c-2h2f-mxf6 (https://github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6). Temporary workaround: disable client_credentials grant type if M2M functionality not required; implement custom token guard middleware enforcing explicit client/user identifier segregation. Review audit logs for anomalous user authentication patterns matching known client IDs to detect prior exploitation. No configuration-based mitigation exists-code-level patch mandatory.