The theory behind the Generalised Cross-Correlation - GCC - (in general, not just the PHAT version of it) uses the cross-correlation of the recorded signals to estimate the delay between them. I am sure you are already aware of that, but if you consider the fact that cross-correlation cannot always differentiate between the different (temporal) components of the signal stream (i.e. different sources), it means that the method works best for single sources.
The method Jonas Schwarz proposes is one possible solution to that, but it may or may not work all the time. I created two different signals, each comprised of three (different) harmonics and delayed one of them in respect to the other by 450 samples. Then I summed them and duplicated the sum with an addition of a delay to the duplicate of 50 samples. Finally, I added a little bit of noise (doesn't really change much but still a nice thing to try). The sampling rate I used is 1 KHz, so it is easy to convert from samples to seconds. You can see the plots below
As you can see the main pick is very well localised and it is right on spot. Now, the next higher is annotated. The value given is about 560, which is definitely off. This, of course, is an oversimplified example here, but as you can see, you can't always be sure that the second peak will necessarily correspond to the second source.
Another approach that has been used in other techniques (such as the broadband MUSIC algorithm) is to divide the spectrum into bands (such as with the use Fourier analysis, or filterbanks) and perform the GCC algorithm in each band. This assumes that in each band only one source will dominate (in a sense, this is the same as considering incoherent sources). From there, you could either use histograms (see 3D Localization of Multiple Audio Sources Utilizing 2D DOA Histograms by Delikaris-Manias et al., DOA Estimation with Histogram Analysis of Spatially Constrained Active Intensity Vector by Delikaris-Manias et al. and references therein) or any other way to estimate the direction of the sources (or even the number of them).
However, you have to keep in mind that, as mentioned above, this will not work under all circumstances. Various approaches as to how to use the acquired cross-correlation functions can be found in Considering the Second Peak
in the GCC Function for Multi-Source TDOA estimation with Microphone Array by D. Bechler and K. Kroschel and in Time-Delay Estimation via Linear Interpolation and Cross Correlation by J. Benesty et al.
Finally, a well structured (in my opinion of course) paper with quite some useful information is Real-Time Multiple Sound Source Localization and Counting using a Circular Microphone Array by Pavlidi et al. The authors in this paper have proposed various methods on how one could approach the problem of localisation (angle estimation only, not distance) and various improvements that have found to work quite well. Keep in mind though that this refers to a circular microphone array.