CVE-2026-73683: Laravel Socialite Facebook OIDC Authentication Bypass

Overview

CVE-2026-73683 is a high-severity authentication bypass vulnerability in Laravel Socialite's Facebook provider. The flaw resides in the getUserByOIDCToken() function within FacebookProvider.php, where the implementation fails to validate the nonce claim in OIDC id_tokens. This oversight allows an unauthenticated attacker who has obtained a valid id_token — through network interception, phishing, or token leakage — to replay it against any application using the affected provider and authenticate as the token's original owner.

The vulnerability carries a CVSS score of 8.1, placing it firmly in the high severity tier.

Technical Details

OpenID Connect (OIDC) specifies that a nonce claim must be present in ID tokens and must be validated by the relying party (the application) to prevent replay attacks. The nonce is a cryptographically random value generated by the client at authentication time and embedded into the authorization request. When the identity provider returns an id_token, the nonce in the token must match the one stored server-side.

In the affected Laravel Socialite Facebook provider code path, getUserByOIDCToken() extracts and trusts user information from the JWT payload without verifying this nonce claim. An attacker who captures a legitimate id_token — even after the original session has ended — can submit it directly to a vulnerable endpoint and receive an authenticated session as the victim user.

// Vulnerable pattern — nonce claim never validated
public function getUserByOIDCToken(string $token): User
{
    $payload = $this->decodeJwtPayload($token);
    // Missing: nonce verification against session-stored value
    return $this->mapUserToObject($payload);
}

The attack requires the adversary to first obtain a valid id_token, but this prerequisite is achievable through several realistic attack vectors including man-in-the-middle interception on insecure connections, cross-site scripting exfiltrating tokens from browser storage, or access to server-side logs that may inadvertently capture token values.

Affected Components

• Package: socialiteproviders/laravel-socialite (and derivatives using the Facebook OIDC flow)
• Function: getUserByOIDCToken() in FacebookProvider.php
• Attack Type: Replay Attack / Authentication Bypass
• Authentication Required: No (unauthenticated attackers can exploit)
• User Interaction Required: No (once token is obtained)

Impact

Successful exploitation allows an attacker to:

• Authenticate as any legitimate user whose id_token they possess
• Access all application resources and data tied to the victim account
• Perform any action the victim user is authorized to perform
• Bypass multi-factor authentication controls that rely on the social login flow

Mitigation

1. Update immediately: Apply the patched version of Laravel Socialite's Facebook provider as soon as it is released. Monitor the package's GitHub repository and security advisories.
2. Disable the Facebook OIDC flow if your application does not strictly require it, falling back to the standard OAuth 2.0 flow.
3. Implement nonce validation manually if patching is not immediately feasible: store a cryptographically secure nonce in the session before initiating the OIDC flow, and verify it against the nonce claim in any received id_token.
4. Audit logs for unusual authentication patterns — look for the same id_token being used across multiple IPs or in rapid succession.
5. Rotate session secrets and invalidate active sessions if you suspect exploitation has occurred.

References

• NVD — CVE-2026-73683
• OIDC Specification — Nonce Implementation Notes