Is CVE-2026-39976 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39976 being exploited in the wild.

How severe is CVE-2026-39976?

High severity, with a CVSS score of 7.1, published 9 April 2026.

Which products and versions are affected?

Laravel Passport >= 13.0.0, =13.0.0, = 13.0.0, < 13.7.1, ECOSYSTEM:introduced=13.0.0,fixed=13.7.1.

Is there a fix for CVE-2026-39976?

Yes. laravel/passport (Packagist): upgrade to 13.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39976 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39976?

Check whether you run Laravel Passport or laravel/passport (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39976: Laravel Passport authentication bypass in TokenGuard

Q: Is there a fix for CVE-2026-39976?

Yes. laravel/passport (Packagist): upgrade to 13.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39976 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-39976?

Check whether you run Laravel Passport or laravel/passport (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39976 · Severity: high · CVSS 7.1 · Published 2026-04-09

Laravel Passport, a tool used to manage API authentication, contains a flaw where machine-to-machine (client credentials) tokens can be mistaken for real user accounts. This occurs because the system may incorrectly match a technical ID used by a machine with a numeric ID belonging to a human user. An attacker or an automated system could inadvertently gain access to a user's private data or perform actions on their behalf without proper authorization.

Vendors: Laravel, Packagist.

Quick answers

Is CVE-2026-39976 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39976 being exploited in the wild.
How severe is CVE-2026-39976?: High severity, with a CVSS score of 7.1, published 9 April 2026.
Which products and versions are affected?: Laravel Passport >= 13.0.0, < 13.7.1, >=13.0.0, <13.7.1; laravel/passport (Packagist) >= 13.0.0, < 13.7.1, ECOSYSTEM:introduced=13.0.0,fixed=13.7.1.
Is there a fix for CVE-2026-39976?: Yes. laravel/passport (Packagist): upgrade to 13.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39976 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39976?: Check whether you run Laravel Passport or laravel/passport (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

laravel/passport (Packagist): upgrade to 13.7.1 or later
```
composer require laravel/passport:^13.7.1
```

Technical details

An authentication bypass exists in Laravel Passport's TokenGuard when processing OAuth2 client_credentials tokens. The underlying league/oauth2-server library sets the JWT 'sub' claim to the client's identifier when no user is present. Passport's TokenGuard passes this value to the user provider's retrieveById() method without verifying that the token is associated with a user. On systems using MySQL with integer primary keys for users and UUIDs for clients, implicit type casting can cause a client UUID to match a numeric user ID (e.g., a UUID starting with '19...' matching user ID 19). This allows a machine-to-machine token to authenticate as a legitimate user. The vulnerability is fixed in version 13.7.1 by ensuring the guard validates the grant type and identifier source.

Affected products

Laravel Passport >=13.0.0, <13.7.1

Identifiers

CVE-2026-39976
GHSA-349c-2h2f-mxf6

Timeline

2026-03-29: disclosed: Issue reported on GitHub
2026-04-01: patched: Fix merged into 13.x branch
2026-04-08: advisory: GitHub Security Advisory published
2026-04-09: advisory: NVD published CVE-2026-39976

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.