Improper Preservation of Permissions Affecting laravel/passport package, versions >=13.0.0, <13.7.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-LARAVELPASSPORT-15990055
- published12 Apr 2026
- disclosed8 Apr 2026
- creditpushpak1300, hafezdivandari
Introduced: 8 Apr 2026
New CVE NOT AVAILABLE CWE-281 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade laravel/passport to version 13.7.2 or higher.
Overview
Affected versions of this package are vulnerable to Improper Preservation of Permissions in the authentication process. An attacker can gain unauthorized access to user accounts by exploiting the handling of client_credentials tokens, which may allow a client token to be misinterpreted as a user token. This is only exploitable if the EnsureClientIsResourceOwner middleware is used together with Passport::$clientUuids set to false.
Workaround
This vulnerability can be mitigated by disallowing usage of client_credentials.