Shion Takabe

**Name of the Vulnerable Software and Affected Versions** Laravel Socialite (affected versions not specified) **Description** The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in the `getUserByOIDCToken()` function within FacebookProvider.php. An attacker with a valid, unexpired id token issued for the same Facebook App ID can submit it to the `userFromToken()` endpoint. Because the system validates the signature, `aud` (audience), and `iss` (issuer) but fails to perform a session-bound nonce comparison, the attacker can gain unauthorized access to victim accounts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.