Laravel Passport, an OAuth2 server implementation for Laravel, versions 13.0.0 up to but not including 13.7.1, contains an authentication bypass vulnerability (CWE-287). The underlying league/oauth2-server library sets the JWT 'sub' claim to the client identifier for client_credentials tokens, which lack a user context. Laravel Passport's token guard uses this 'sub' claim to retrieve a user by ID without verifying that the ID corresponds to a real user. Consequently, a machine-to-machine token may inadvertently authenticate as an unrelated legitimate user. This flaw was addressed and fixed in version 13.7.1.

An attacker with a valid client_credentials token can bypass intended authentication controls and impersonate an unrelated real user. This leads to unauthorized access with potentially high confidentiality impact, as the attacker may gain access to user-specific resources or data. The integrity impact is lower but still present due to limited modification capabilities, and availability is not affected. The CVSS score is 7.1 (High).

Upgrade Laravel Passport to version 13.7.1 or later, where this authentication bypass vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is not explicitly stated but the fix is available in the specified version.