Authentication Bypass in Laravel Socialite's Facebook Provider by Laravel

CVE-2026-73683

What is CVE-2026-73683?

An authentication bypass vulnerability exists in Laravel Socialite's Facebook provider, where the absence of nonce claim validation in the getUserByOIDCToken() function can be exploited. This allows unauthorized attackers to replay captured OIDC id_tokens, provided they have access to a valid, unexpired id_token associated with the same Facebook App ID. When these tokens are submitted to the userFromToken() endpoint, security checks relating to signature, audience (aud), and issuer (iss) are validated, but the crucial session-bound nonce comparison is not performed, leading to unauthorized access to user accounts.

References