laravel/passport

Packagist1 known CVE affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting laravel/passportpage 1 of 1

CVE-2026-39976HIGHCVSS 7.1EG 7.1✓ Fixed in 13.7.1
2026-04-09
vulnerable: v13.0.0 ... v13.7.0 (20 versions)
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (si…

Check whether laravel/passport is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for laravel/passport CVEs against the assets you own.

Start Free Scan →