Laravel Passport’s TokenGuard incorrectly treats the OAuth2 client identifier as a user identifier. When a client_credentials token is issued, the library sets the JWT "sub" claim to the client ID, and the guard passes this directly to the user lookup without verifying it refers to a real user. The result is that a machine‑to‑machine token can authenticate as an unrelated real user, enabling unauthorized access and identity spoofing (CWE‑287).

All installations of Laravel Passport between versions 13.0.0 and 13.7.0, inclusive, are vulnerable. The issue originates in the league/oauth2-server library that Passport depends on. Any application using these versions and issuing client‑credential tokens is affected.

The flaw has a CVSS base score of 7.1, indicating medium‑to‑high severity. Exploit probability data is not available, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker must acquire a valid client_credentials token, typically through compromise of client credentials or misconfiguration, and then use it to access resources that expect a genuine authenticated user. The attack does not require external exploitation beyond the authentication subsystem.