CVE-2026-39976

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

• CWE-287

• https://github.com/laravel/passport/issues/1900Exploit, Issue Tracking
• https://github.com/laravel/passport/pull/1901Issue Tracking, Patch
• https://github.com/laravel/passport/pull/1902Issue Tracking, Patch
• https://github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6Mitigation, Vendor Advisory
• https://github.com/thephpleague/oauth2-server/issues/1456#issuecomment-2734989996Issue Tracking, Patch

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3997The Text Toggle plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-39970TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…8.5
• CVE-2026-39971Serendipity is a PHP-powered weblog engine. In versions 2.6-…7.2
• CVE-2026-39972Mercure is a protocol for pushing data updates to web browse…7.1
• CVE-2026-39973Apktool is a tool for reverse engineering Android APK files.…7.1
• CVE-2026-39974n8n-MCP is a Model Context Protocol (MCP) server that provid…8.5
• CVE-2026-39977flatpak-builder is a tool to build flatpaks from source. Fro…6.3
• CVE-2026-39979jq is a command-line JSON processor. In commits before 2f090…6.5
• CVE-2026-3998The WM JqMath plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2026-39980OpenCTI is an open source platform for managing cyber threat…7.2
• CVE-2026-39981AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.…8.8
• CVE-2026-39983basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basi…8.6