CVE-2026-73683

Name of the Vulnerable Software and Affected Versions Laravel Socialite (affected versions not specified)

Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. An attacker with a valid, unexpired id token issued for the same Facebook App ID can submit it to the userFromToken() endpoint. Because the system validates the signature, aud (audience), and iss (issuer) but fails to perform a session-bound nonce comparison, the attacker can gain unauthorized access to victim accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.