Skip to content
Threat Feed
Subscribe

Tag

Passport

1 brief RSS
high advisory

Laravel Passport Authentication Bypass via Client Credentials Tokens

Laravel Passport before v13.7.1 allows an authentication bypass via client credentials tokens, where a client's identifier can be used to impersonate a user if `Passport::$clientUuids` is set to false or the EnsureClientIsResourceOwner middleware is in use.

Laravel Passport laravel passport oauth2 authentication-bypass
2r 1t