EUVD-2026-20970
GHSA-349c-2h2f-mxf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain client_credentials OAuth2 token
-
DeliverySet JWT sub claim to valid user identifier
-
ExploitPass token to retrieveById()
-
ExecutionGuard resolves to authenticated user
-
ImpactBypass authentication as target user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Laravel Passport 13.0.0 to 13.7.0 with OAuth2 client_credentials grant enabled. Attacker requires valid client credentials (client_id and client_secret) to obtain a token. Token guard must use retrieveById() without validating the JWT sub claim is an actual user identifier. Remote exploitation, no victim interaction needed. |
| Impact | CVSS 7.1 reflects high confidentiality impact via cross-tenant user impersonation. Authenticated attackers exploiting client_credentials tokens can escalate privileges to arbitrary users without credential validation. Elevated observed exploitation activity significantly increases real-world priority. Scope change (S:C) amplifies blast radius across multi-tenant Laravel deployments. |
| Exploit ScenarioDerived | Attacker obtains valid machine-to-machine client_credentials token. Token's JWT sub claim contains client ID; attacker supplies arbitrary user ID to retrieveById(). Guard authenticates as unrelated user without validation. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Authentication bypass in Laravel Passport 13.0.0-13.7.0 allows machine-to-machine OAuth2 client_credentials tokens to impersonate arbitrary application users. The league/oauth2-server library sets JWT sub claim to client identifier for M2M flows; Passport's token guard fails to validate this identifier represents an actual user before passing to retrieveById(), enabling any M2M token to authenticate as unrelated real users. Affects all deployments using client_credentials grant type. Requires low-privilege authenticated access (PR:L). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Laravel Passport 13.7.1 immediately. Fixed versions implement sub claim validation to prevent client identifier resolution against user models. Upstream fixes available via PR #1901 and PR #1902 per GitHub advisory GHSA-349c-2h2f-mxf6 (https://github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6). Temporary workaround: disable client_credentials grant type if M2M functionality not required; implement custom token guard middleware enforcing explicit client/user identifier segregation. Review audit logs for anomalous user authentication patterns matching known client IDs to detect prior exploitation. No configuration-based mitigation exists-code-level patch mandatory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause: missing user identifier validation in token guard chain. oauth2-server populates sub with client_id per spec; Passport guard invokes retrieveById(sub) without type checking, causing resolution against user table instead of client table (CWE-287). Cross-scope confusion between client and user identity domains enables privilege escalation from M2M context to user session.
Know when Laravel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.
Executive ViewAI
Laravel Passport versions 13.0.0-13.7.0 contain an authentication bypass flaw in machine-to-machine OAuth2 flows that allows any authenticated API client to impersonate arbitrary application users without additional authorization. This affects all organizations using Passport's client_credentials grant type and exposes user data and functionality to lateral privilege escalation by any party with valid M2M credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement custom middleware in token guard to validate JWT sub claim against actual user database before granting authentication; (2) Restrict M2M token distribution to only essential integrations and enforce least-privilege scopes; (3) Enable detailed audit logging of all M2M token usage and implement alerting for tokens authenticating as multiple distinct users; (4) Temporarily disable client_credentials grant type if not critical to operations, or isolate affected Passport instances to lower-trust environments until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera
Laravel TokenGuard authentication bypass is a genuine high-priority issue, not an inflated CVSS score: unauthenticated a
Exploit-DB