CVE-2026-39976

Katalog CVE

CVSS 7.1 · High EPSS 0,40%

Kerentanan Improper Authentication pada laravel passport. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/laravel/passport/security/advisories/GHSA-349c-2h2f-mxf6 mitigasi · advisory vendor
• https://github.com/laravel/passport/pull/1901 issue tracking · patch
• https://github.com/laravel/passport/pull/1902 issue tracking · patch
• https://github.com/thephpleague/oauth2-server/issues/1456#issuecomment-2734989996 issue tracking · patch
• https://github.com/laravel/passport/issues/1900 exploit · issue tracking