CVE-2026-73683 in Socialite
Summary
by MITRE • 08/14/2026
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability resides within Laravel Socialite's Facebook provider implementation where the getUserByOIDCToken() function fails to validate the nonce claim present in OpenID Connect id_tokens. The nonce parameter serves as a critical security mechanism designed to prevent replay attacks by ensuring that tokens are only valid for specific authentication sessions. When an attacker captures a legitimate id_token issued by Facebook for a particular application, they can exploit this flaw by submitting the token to the backend userFromToken() endpoint without proper validation of the nonce claim. The vulnerability stems from the absence of session-bound nonce comparison, allowing attackers to bypass authentication controls despite passing signature verification, audience (aud) validation, and issuer (iss) checks.
The technical exploitation occurs through a direct manipulation of the OIDC token validation process where the FacebookProvider.php implementation performs basic cryptographic verification but omits the crucial nonce validation step. This creates an authentication bypass scenario where attackers can impersonate legitimate users by leveraging previously captured tokens. The vulnerability specifically impacts the OpenID Connect flow within Laravel Socialite, which is commonly used for social login integrations and relies on proper token validation to ensure security. According to CWE-347, this represents a weakness in cryptographic signature verification where the system fails to validate critical components of the authentication protocol.
The operational impact of this vulnerability extends beyond simple unauthorized access to full account compromise within applications utilizing Facebook Socialite integration. Attackers can potentially gain persistent access to victim accounts, escalate privileges through session hijacking, and perform actions as authenticated users without legitimate credentials. The vulnerability affects any application that relies on Laravel Socialite's Facebook provider for authentication and uses OpenID Connect token validation. The attack vector is particularly dangerous because it requires minimal reconnaissance beyond capturing a valid token, making it suitable for automated exploitation tools. Security practitioners should note that this issue aligns with ATT&CK technique T1566.002 which covers credential access through social engineering and token manipulation.
Mitigation strategies must address the core validation flaw by implementing proper nonce claim validation in the getUserByOIDCToken() function. Applications should generate and store unique nonce values during the initial authentication flow, then validate these nonces against those present in incoming id_tokens before proceeding with user authentication. The implementation should also enforce additional security controls such as token expiration checks, audience verification, and proper session management. Organizations using Laravel Socialite with Facebook integration should update to patched versions immediately and consider implementing additional monitoring for unusual authentication patterns or token usage. Security measures should include validating that nonces are properly generated, stored in secure session storage, and compared against the received token values to prevent replay attacks. The vulnerability highlights the importance of comprehensive protocol implementation where all security mechanisms within OAuth 2.0 and OpenID Connect flows must be properly enforced to maintain authentication integrity.