CVE-2026-73683

Received Received - Intake

Authentication Bypass in Laravel Socialite Facebook Provider via OIDC Token Replay

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-14

Generated

2026-08-15

AI Q&A

2026-08-15

EPSS Evaluated

N/A

NVD

CVE-2026-73683

Affected Vendors & Products

Vendor	Product	Version / Range
laravel	socialite	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

Laravel Socialite's Facebook provider has an authentication bypass flaw. Unauthenticated attackers can replay captured OIDC id_tokens by exploiting missing nonce claim validation in the getUserByOIDCToken() function. This allows attackers to bypass authentication controls and gain unauthorized access to victim accounts using a valid, unexpired id_token issued for the same Facebook App ID.

Impact Analysis

This vulnerability allows attackers to impersonate users, access sensitive data, or perform actions on behalf of victims without authentication. If you use Laravel Socialite with Facebook provider, attackers could hijack user sessions, steal personal information, or gain administrative privileges depending on the application's functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's access controls. Organizations may face compliance violations, fines, or legal consequences if user data is compromised due to this flaw.

Mitigation Strategies

Update Laravel Socialite to the latest version that includes nonce claim validation in the Facebook provider. Review and restrict access to the userFromToken() endpoint to prevent unauthorized token replay attacks. Monitor logs for unusual authentication attempts or repeated token submissions.

Hi! I’m here to help you understand CVE-2026-73683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70