Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client_credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

认证机制不恰当

passport 授权问题漏洞

passport是美国Jared Hanson个人开发者的一个与 Express 兼容的 Node.js 身份验证中间件。 Passport 13.0.0至13.7.1之前版本存在授权问题漏洞，该漏洞源于client_credentials令牌的身份验证绕过，可能导致任何机器对机器令牌无意中认证为实际用户。

N/A

N/A