Executive brief
Laravel Passport, a tool used to manage API authentication, contains a flaw where machine-to-machine (client credentials) tokens can be mistaken for real user accounts. This occurs because the system may incorrectly match a technical ID used by a machine with a numeric ID belonging to a human user. An attacker or an automated system could inadvertently gain access to a user's private data or perform actions on their behalf without proper authorization.
Technical details
An authentication bypass exists in Laravel Passport's TokenGuard when processing OAuth2 client_credentials tokens. The underlying league/oauth2-server library sets the JWT 'sub' claim to the client's identifier when no user is present. Passport's TokenGuard passes this value to the user provider's retrieveById() method without verifying that the token is associated with a user. On systems using MySQL with integer primary keys for users and UUIDs for clients, implicit type casting can cause a client UUID to match a numeric user ID (e.g., a UUID starting with '19...' matching user ID 19). This allows a machine-to-machine token to authenticate as a legitimate user. The vulnerability is fixed in version 13.7.1 by ensuring the guard validates the grant type and identifier source.
Affected products
- Laravel Passport >=13.0.0, <13.7.1
Timeline
- 2026-03-29: disclosed: Issue reported on GitHub
- 2026-04-01: patched: Fix merged into 13.x branch
- 2026-04-08: advisory: GitHub Security Advisory published
- 2026-04-09: advisory: NVD published CVE-2026-39976