The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in the `getUserByOIDCToken()` function within FacebookProvider.php. An attacker with a valid, unexpired id token issued for the same Facebook App ID can submit it to the `userFromToken()` endpoint. Because the system validates the signature, `aud` (audience), and `iss` (issuer) but fails to perform a session-bound nonce comparison, the attacker can gain unauthorized access to victim accounts.